Fix: Actually enable CORS

MAGIC