Merge "Only return CORS headers in the response as required"