CORS fixes

Fix silly header overwriting