Allow fxpay headers via CORS (bug 1104371)

@andymckay r?
i don't think there's any real downside in sending the headers and it could be useful to us at some point in the future