Always set Access-Control-Allow-Origin for tile responses

This allows "simple" requests using CORS to be cached as we will
always say they are allowed even if the client didn't actually ask
for CORS by specifying an origin.

Preflight requests will still be handled by mod_tile which may add
additional headers for a fuller response.