expanded CORS privileges for Fireplace requests