FIX: Access-Control-Allow-Origin header

Now works with the miniprofiles as well.