Revert "Use `res.removeHeader` instead of setting CORS headers to empty string"
It looks cleaner, but breaks pubsub (or at least pubsub tests) for some reason, and there's nothing wrong with having them be empty strings.

This reverts commit 0bc7a498c2fac4a9a6570f03fa3ea71cb9891313.
Set CORS headers on CSRF denial responses, for easier debugging
Without this, a cross-domain POST with a bad token will get a CORS error in the browser, obscuring the fact that the problem is really a CSRF token mismatch.