add CORS ACAO allow all header to GET requests

This allows browsers to use fake-s3 signed GET URLs, such as those
generated by the AWS JS SDK.