Missing CORS headers

For the first /.well-known/openid-configuration request, CORS headers are missing. They could be added by modifying the .htaccess, but it better to implement it in the plugin.