HB|AN: Adding Allow-Access-Control-Header to responses where requests
include it