Generic CORS support (for now)