Add headers to CORS