Better CORS handling. Use constants