Adding CORS headers to "Access Denied" responses.