Bugfix in CORS handling.