Properly call CORS everywhere.