Fix 500 for CORS requests, and add a test