Initial implementation of allowing cross-origin requests in the webfinger flow, so that the unhosted guys can use Diaspora.  May not work with caches-page on host-meta.  We'll have to use X-Accel-Redirect or something.