Enable CORs in the right place