Add CORS headers to routes