moving CORS to HTML5