Send correct CORS headers

Allow all hosts to access the API