CORS configuration allowing all domains.