* feat(core): set CORS headers on protocol errors This ensures the frontend can read the error message instead of just showing a CORS error * fix statuscode