     msgId = match[1]
 
     if req.method == 'OPTIONS'
-      res.writeHead 204,
+      res.writeHead 204, Object.assign {}, accessHeaders(req),
         Allow: 'OPTIONS, GET, HEAD'
-        'Cache-Control': 'stale-while-revalidate'
-        'Access-Control-Allow-Origin': allowCors
       return res.end()
 
     ## handle_auth()


defaultContentType = 'application/octet-stream'

## Allow files to be embedded in other sites, e.g. Cocreate.
## Note that this still requires Coauthor authentication via cookies.
allowCors = '*'

## Mimicking vsivsi:file-collection http_access_server.coffee
WebApp.rawConnectHandlers.use '/file',

      return res.end "#{username} lacks read permissions for group of message/file #{msgId}"

    ## get()
    headers = Object.assign {}, accessHeaders(req),
      'Content-Type': 'text/plain'
    if req.headers['if-modified-since']
      since = Date.parse req.headers['if-modified-since']  ## NaN if invaild
      if since and req.gridFS.uploadDate and (req.headers['if-modified-since'] == req.gridFS.uploadDate.toUTCString() or since >= req.gridFS.uploadDate.getTime())
