DRY the CORS support for endpoints