Normalize CORS response headers