RSS and JSON feeds should return Access-Control-Allow-Origin header check should be reworked

[sesh]

Just reviewing the code of this one while adding some test cases and there's definitely better ways to do this.