Enable CORS correctly this time