Move AddAccessControlHeaders to extensions