[css-shapes] cors-same-origin placeholder