Add CORS header to API responses