Intercept CORS headers