Set CORS headers on API requests