Add CORS headers to app.py.