Add CORS headers site-wide.