CORS accepts all