Set up res.headers in socket response if it's empty.
Changed 'setHeader' to 'set' wherever it appears
Made CORS socket requests fail by default if 'allRoutes' is false.