Allow CORS requests for mini manifests (bug 994423)

Those headers were already there, if I'm not wrong. Of course, you could remove them if you prefer.