CORS was a mistake