allow cors for wms / tile requests

[timwaters]

need to add Access-Control-Allow-Origin to these requests for use in mapbox js?

Need a code snippet ideally to see if it's really needed