4xx and 5xx responses do not include CORS headers, causing browser CORS errors on auth failures.
4xx and 5xx responses do not include CORS headers, causing browser CORS errors on auth failures.