Isn't there some standard about which status code a CORS request should send in case the CORS is not authorized?