Clover not attaching CORS headers

Hi,

I'm having a situation that Clover does not attach the CORS headers on response and, as expected, the browser just blocks the response. In my case I am trying to retrieve the devices, but tried other routes with the same result - no CORS headers attached.

I have the necessary permissions, if I do a non-AJAX request I can see the devices, but the CORS headers are not attached.

The strangest part is that with the sandbox it is working as expected, with the same settings (I am referring to OAUth url and CORS url).

Any ideas on this? If this is a known Clover issue, please tell me about it so that I stop hammering for the config and start in another direction.

Thanks, George