Add CORS for /events