Revert "Remove Access-Control-Allow-Origin after all"

This reverts commit c718cf1d483b2570b886269cf990458b195500b5.

Gratipay static files are served from https://assets.gratipay.com/,
and hosting on subdomain is not enough to bypass same-origin policy
used by browsers. Therefore we need Access-Control-Allow-Origin

Fixes issue #2970.
https://en.wikipedia.org/wiki/Same-origin_policy
Document why we need Access-Control-Allow-Origin (issue #2970)
Merge pull request #2999 from gratipay/corsfix

Fix #2970 Font problem in production