Putting back CXF CORS