Replace hardcoded CORS header with Rack proxy to reuse actual CORS settings