Fixed CORS breaking logic error

Caught a stealthy bug that prevented any cross origin requests.