Enhancement: add Access-Control-Allow-Origin *; for assets