Express middleware that allows CORS in the most permissive way