make CORS work with plain JS object JSGIResponse

"Access-Control-*" headers are overwritten by this middleware