Add CORS for allowed domain in .htaccess