Add Access-Control headers for response