Set CORS headers on all responses.