CORS support via Site::