Add CORS support to locations GET header