Allow CORS requests for mini manifests (bug 994423)

I think adding `OPTIONS` for pre-flight CORS checks would be a good thing.

But, there's other parts of `assertCORS` that will also fail. This is also outside of the traditional marketplace api so it won't have the `API-Status` or `API-Version` headers either. This decorator also doesn't set the `'Access-Control-Allow-Headers'` which I'm not sure we need in this case either.