Tests and bug fixes for new CORS headers