Fix dealing with CORS (fixes #20)