Test that 4xx responses contain CORS headers.
Fix CORS support for exceptions.