Setup CORS to allow *