Totally changed the CORS headers.
Now, there is no CORS, just custom headers to be set before the handlers are actually called.
There is still the redirects 200 for any OPTIONS request though.