CORS headers fixed