[security] Add CORS headers

Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods in CORS successfull headers