Fix all CORS headers