Refactor CORS handling to have single entrypoint