Added try/catch around Platform::setInstanceState guts. CORS change to return "*" if configured with "*" regardless of the origin.