CORS for SSI pages