Adds CORS headers for all controllers