So let it be written, so let it be CORSed

Ratings APIs need to be CORSed.