[minor] Some important test placeholders
[fix] Only handle cors when the correct header is set