Use CORS headers in all responses