Allow JSON content-type in CORS