More CORS fixes