Tweaked CORS config so it's only applied to certain routes