Relax CORS requirements for TPF servers

See discussion at http://lists.w3.org/Archives/Public/public-hydra/2014Oct/0083.html