Fix location header in CORS