Add missing cors headers