refs #4996 set CORS header if bulk request is used