CORS options for reporting API