Move CORS to prevent header data overwrite