Allow customizing CORS headers