Add CORS to the response headers.