You can now add a cors=true parameter to most requests if you need the header e.g.

http://blockchain.info/unspent?cors=true