Currently, CORS is not enforced, it is only sent in response headers, not removed from request headers. Need to fix that as well