CORS headers for autocomplete