Add CORS for upload too