Update the x-origin treatment. CrossOriginResponse probably needs readable CORS headers.