Ensure CORS headers are sent on authenticated resources, too.
Set all relevant integration tests as @Transactional so tx'es rollback.