Add CORS headers to responses