FIX: Access-Control-Allow-Origin header

The Access-Control-Allow-Origin header now allows store.steampowered.com, since it has to allow the domain just under the TLD to work.