CORS header for history endpoint