Enabling CORS at various scope