Corrected following advice from Alexander Langer
Added CORS filters with a bogus ContainerResponseFilter