CORS is being a bitch