Add CORS to all requests