Add primitive "allow all" CORS support