Cowboy middleware for CORS headers