Allow CORS for heatmap cross-domain loading