Reproduce CORS missing headers

As a good start, ticket #48 is reproduced in a test case :)