CORS support, because JavaScript is dumb