Allow CORS requests for packaged apps' zip files