Allow CORS clients to read Location headers