Location should not be set
Header locations is exposed to CORS