Fix: enable CORS.