Fix CORS headers so that they actually work.
Rename enable-xss to enable-cors