Got the CORS headers right this time