[corest] Fix CORS: Access-Control-Allow-Origin was set twice

Previous merge introduce bug. Access-Control-Allow-Origin header was set twice.