- right, cors headers are on the response, not the request