Bug 3414 - exposed location header in CORS setings