Add CORS setting for xs engine.