Removed CORS from core and added to host (see #144)