Enable CORS for everything under /run

Change-Id: Ia32d04019e6a87830daf158f4ee87c9f6b573f75