Cors headers need to go on every request.