Add CORS middleware