Add CORS headers to eventsource