CORS security improvements