Fix for #281

Send 403 Forbidden instead of 400 Bad Request as more logical response code

Not set CORS headers when origin in fact is not allowed to access