Make CORS actually work