Try to return a very permissive cors header