DONT MERGE - Switch over to using cors everywhere

Currently reqwest doesn't handle IE8 & 9's `XDomainRequest` (https://github.com/ded/reqwest/issues/99), so hold off on merging until I've put a pull request in