CORS cleanup

Closes #426