fix(CORS): also send on HTTP host