Always enable CORS for the API.