Add CORS headers for GET requests