Reproduce CORS missing headers

As a good start, ticket #48 is reproduced in a test case :)
I don't think so, but I don't think that should be a requirement.

the trick I did could also work if we let `Response()` and add the cornice trick just after.