Add CORS header for assets