CORS not set when error returned

[lautarodragan]

When running GET https://api.poetnetwork.net/tokens with an expired token, the response is Expired token., but CORS headers aren't set in the response, so an error is thrown in clients which implement CORS (browsers) which makes it impossible to read the response.

GET https://api.poetnetwork.net/tokens 422 (Unprocessable Entity)
Access to fetch at 'https://api.poetnetwork.net/tokens' from origin 'http://localhost:3001' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
Uncaught (in promise) TypeError: Failed to fetch