Make sure font requests works through cdn

The cors origin header param needs to be more generous.