Add CORS Access-Control header to data paths