enabling CORS

this is in hope that it fixes a problem with the Silent Hill font not
being loaded in production