Fix handling CORS

Bump 0.4.2