FIX: Access-Control-Allow-Origin header

We brainfarted, it works correctly with the first version. Reverted.