Allow CORs from any endpoint.