Header Images: fix cropping for users without the 'customize' capability

[mattwiebe]

I think I found a Core bug here. There's absolutely no reason for the ajax request to include wp_customize=on, the logic is entirely handled in the wp_ajax_crop_image() handler.

This commit appears to have moved the logic from the Customizer into a more general purpose context while leaving the constraining wp_customize=on parameter.

I guess this could be a core patch

Fixes #846

Proposed changes:

Make a custom controller but without wp_customize=on

Other information:

• [ ] Have you written new tests for your changes, if applicable?

Testing instructions:

• Go to '..'