Improved CORS config