link CORS on first mention, not second