Clarify when and where CORS headers should be returned.