Add web-app filter for CORS headers