only send cors headers for GET '/q/*' requests.