CORS headers not making it into the response

[jjvdangelo]

Not sure if this should be opened up on Fix or Simple.Web, but here goes.

It appears that the CORS headers are not being written to cross-origin requests. I have configured a simple site to that uses "*" and none of the cross-origin requests coming back have the header and, as expected, the browser chokes.