CORS headers in the .htaccess