Allow Imbo-headers for CORS-requests

Ref #297 - we should allow clients to send Imbo-headers to the server.

This also fixes a bug where unsigned/incorrectly signed requests would not get the `Access-Control-Allow-Origin`-header added, which made it difficult to debug.
They're both **fixed** in #298, while #297 is the issue that brought it to my attention.