CORS filter a bit noisy

[Benson Margulies]

It looks to me as if the CORS filter has a bug: it returns headers
even when the request is not cross-origin. Sergey, WTYT? I'm sure it's
not a tragedy and that I could fix that easily enough.