Set CORS headers on every request