Allow fxpay headers via CORS (bug 1104371)

@andymckay r?
I'm feeling ambivalent about this. Should we allow these headers or not? It's possible to modify fxpay so that it doesn't send a version header to the receipt verifier.