Moved CORS handling to Util class