Hi, i was busy in some other priority items.
Anyhow while it did not work for a simple controller as well and i think this is the reason behind.
it appears that we are mixing two different approaches for enabeling CORS which is not recommended as stated in the above link.