FIX CORS in a non valid jwt request.

[ping86]

When we do a request with a expired jwt token, varnish returns a response without CORS header