Loosen up CORS for beta testing