Lumen preflight error on download response

Question

I'm trying to return a downloadable response from my get request in lumen like so

return response()
       ->download($full_filename, $filename, ['Access-Control-Allow-Origin' => '*'])
       ->deleteFileAfterSend(true);

Но я получаю эту ошибку:

XMLHttpRequest cannot load http://domain.dev/inner-route. В запрошенном ресурсе отсутствует заголовок "Access-Control-Allow-Origin". Источник ' http://localhost:8080/', следовательно, не имеет доступа. Ответ имеет HTTP-код состояния 500.

For reference, I have an options provider as

public function register() {
    if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        $path = explode('?', $_SERVER['REQUEST_URI']);
        app()->options($path[0], function() { return response('', 200); });
    }
}

and a CORS middleware like

public function handle($request, \Closure $next) {
    $response = $next($request);
    $response->header('Access-Control-Allow-Methods', 'HEAD, GET, POST, PUT, PATCH, DELETE');
    $response->header('Access-Control-Allow-Headers', $request->header('Access-Control-Request-Headers'));
    $response->header('Access-Control-Allow-Origin', '*');

    return $response;
}

Что я делаю неправильно?