Mark CORS responses as uncacheable