Bug: cors headers was not used