be less generous with CORS response headers; Opera is more strict (e.g., throw exception if Access-Control-Allow-Origin: * received on a same origin request)