CORS + EventSource update