Add CORS headers before authentication