Config URL now has CORS headers.