fix wrong handling of "Access-Control-Allow-Origin"