fix(CORS): add Access-Control-Allow-Origin header