Allow all script access, XSS risk seems low

Open the CORS door wide!