3.08: ensure CORS headers are on halted requests