Toggle CORS when the remote URL doesn't contain the current window.location.origin