Fix CORS without x-headers