Set CORS headers on API responses.