Add CORS headers on all API responses