More stuff in object model, CORS headers