Set CORS headers on .well-known requests