CORS fixes

* Non-default origins were not connected.
* Chrome preflight requests require `origin` and `accept` headers.