Configure CORS (allowedOrigin is all by default)