Allow CORS for data requests