Send Access-Control headers on each response
Respect 'hold' attribute (hardcoded for hold == 1)