Use `res.removeHeader` instead of setting CORS headers to empty string
Added metadata to more CORS route bindings