Example map:
From Chrome console:
Access to image at 'https://gallica.bnf.fr/iiif/ark:/12148/btv1b531700621/f2/14336,12288,1924,2048/241,/0/native.jpg' from origin 'https://viewer.allmaps.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
The following header is present on the response:
Access-Control-Allow-Origin: *
But perhaps not always returned? Or sometimes there's no response at all?
(Potential relation to #10 if IIPServer is used)