Enable cross-origin isolation

[bates64]

We should set the following headers in both dev (vite) and prod (vercel?) - possibly in hooks.server.ts:
https://web.dev/cross-origin-isolation-guide/#enable-cross-origin-isolation

We won't need these headers for now but

1. its more secure
2. it will create less pain when we eventually need SharedArrayBuffer