Add CORS header on redirects