Only return CORS headers in the response as required