First pass on the CORS middleware