Add CORS header to embed#show