Collector: add CORS header