I don't like it either. Furthemore the "prePopulateCorsResponse" set a 403 error if invalid, so it shoudl return immediately. We need to find osmething better here.