Set CORS headers for GET/POST user