Add cors support. Allowing all domains for now