CORS and websockets