Clarify CORS same-origin and CORS cross-origin.