Shim ajax, add CORS headers