Send permissive CORS headers.