Reproduce CORS missing headers

As a good start, ticket #48 is reproduced in a test case :)
Does HTTPUnauthorized and HTTPForbidden returns a JSON response?