Define header parsing a bit more centralised and note open issues in CORS check a bit better