Fixes to the CORS headers