Cross-origin asset matrix

Controlled CORS, preflight, credential, opaque response, MIME, font and image policy fixtures.