Even more anti-CORS headers (definitely need config for this)