Added access control header for start mode
Added access control header for start mode

no refs

- since portal script is loaded with `crossorigin:anonymous` now, we need to pass in the access control headers for script to bypass cors check

TryGhost/Ghost,TryGhost/Ghost,TryGhost/Ghost