Ensure CORS headers are only sent to salesforce