Don't restrict CORS to Prelude only.