Updated CORS permissions