Provide CORS headers in non-OPTIONS requests