Bug in CORS code