CORS fixes for content-type