Allow CORS for .*