Allow CORS requests for mini manifests