Add CORS handling for ajax