Fix #81 CORS verify needs to follow spec