Add headers for CORS requests