Setting access control headers to be more permissive on GET