Or they can use CORS

I think you can leave this line out.  We'll put the instructions in the SSL module somewhere