Moved CORS headers into modules.