marketplace:nginx: set Access-Control-Allow-Origin for signed* from upstream.