Always write CORS headers.