Fix up CORS support