Decorating CORS headers automagically for browsers