why only CORS? let's have Java, Flash and Silverlight join the party