Add CORS

Implementation untested