Apply CORS for GET as well