CORS also requires to send the "Access-Control-Allow-Origin" header on direct requests or requests following preflight requests.
Resto_cohttp.Server