Add CORS to middleware requests