Add CORS to server responses