CORS fix #406

See #406