Access-Control-Allow-XXX responds with what the client wants; meaningful error messages