CORS support on static content