config: "allow-origin" key, server: handle HEAD