Enable CORS for OAuth routes