Set cors headers when a response is returned or exception is raised

When a view raises an exception or returns a Response object, cors allow-origin headers are not set. This PR makes sure the headers are set.