Fix CORS headers on image assets for serving to app cards

[Tom Harrigan]

For most users with a vanilla setup, serving of assets will probably be blocked due to CORS settings. Use the allowed_http_origins filter to add http://ask-ifr-download.s3.amazonaws.com to the list.

Ref: https://developer.amazon.com/public/community/post/Tx15T24P9QV8RXN/New-ASK-Features-Standard-Home-Cards-with-Image-Support

Note: Sites should use a CDN to serve up the images, but we should handle this case. Since it's just a filter, it can be removed if a site wishes.