Default to permissive CORS headers, and also send them on html2wt

Change-Id: Ib1135e7ec7c6fa67b255223c3a5f8e8728fe4f87
Merge "Default to permissive CORS headers, and also send them on html2wt"