allows CORS to be limited oh and fix assertImmediate (bug 856664)