More permissive CORS policy for APIs