Add CORS filter on responses