Set CORS header on cache only if it has not been set already (fixes #2897)