fix GH-211, set CORS headers when sending error message