Allow all X-Imbo-* headers on CORS-requests