Added access control headers for product contents.

...Allow-Headers config may be up for debate.