title: Is canvas security model ignoring access-control-allow-origin headers?
body: <p>It seems that even if you set the access-control-allow-origin header to allow access from mydomain.org to an image hosted on domain example.org, the canvas' origin-clean flag gets set to false, and trying to manipulate that image's pixel data will trigger a security exception.</p>
  
  <p>Shouldn't canvas' obey the access-control-allow-origin header and allow access to image's data without throwing an exception?</p>