Fix CORS headers so that they actually work.