Using Tomcat's CORS implementation