Remove Access-Control-Allow-Origin after all

This was essentially a no-op, since gratipay.com would be the default
anyway.