Add CORS support for device state toggling