Honestly I can't remember why we have Access-Control-Allow-Origin set, so hopefully removing it does not break anything.