Update CORS Allow-Origin + content-type + always use answer()