Not sending Allow or CORS headers on 304 (already has this info / could be discovered with HEAD/OPTIONS)