Fix: CORS headers should not be included, if not a CORS request.