Add CORS headers to api