Allow mayday.us for CORS