Set correct CORS headers