Allow Imbo-headers for CORS-requests

Ref #297 - we should allow clients to send Imbo-headers to the server.

This also fixes a bug where unsigned/incorrectly signed requests would not get the `Access-Control-Allow-Origin`-header added, which made it difficult to debug.
Should this line say #297?