Allow CORS headers on avatar image responses

[kylebakerio]

For my app, I want users to be able to be represented by their use avatar in 3d. A crossorigin="anonymous" request doesn't work, which adds the unnecessary overhead for a dev of implementing a proxy on their own backend to implement this feature. This also doesn't seem clearly documented anywhere, so easy to go on a wild goosechase tracking this down--CORS issues are always a pain.

Please support cross origin requests by responding with the correct headers.