Allow customizing cors response headers