Allow CORS for static content as well.