Set CORS headers in production.