Allow CORS for the client app