Add CORS to middleware