Fix referrer in cors handler