Revert "Remove Access-Control-Allow-Origin after all"
Revert "Remove Access-Control-Allow-Origin after all"

This reverts commit c718cf1d483b2570b886269cf990458b195500b5.

Gratipay static files are served from https://assets.gratipay.com/,
and hosting on subdomain is not enough to bypass same-origin policy
used by browsers. Therefore we need Access-Control-Allow-Origin

Fixes issue #2970.
https://en.wikipedia.org/wiki/Same-origin_policy

studio666/gratipay.com,gratipay/gratipay.com,gratipay/gratipay.com,eXcomm/gratipay.com,eXcomm/gratipay.com,mccolgst/www.gittip.com,studio666/gratipay.com,mccolgst/www.gittip.com,mccolgst/www.gittip.com,mccolgst/www.gittip.com,eXcomm/gratipay.com,gratipay/gratipay.com,eXcomm/gratipay.com,studio666/gratipay.com,gratipay/gratipay.com,studio666/gratipay.com