Inject CORS header in sneaky way