Do not send a CORS header in release mode

Review 1169 by @neumino