Move CORS to middleware