Replace Microsoft.Owin.Cors with just System.Web.Cors.
Add runAllManagedModulesForAllRequests=true