Allowing CORS for the moment