Added cross-origin resource restrictions (moved from the main spec)