Fetch a URL's response headers (CORS-free).
Fetched server-side, so it works for any URL regardless of CORS.