what if both SSL and CORS are passed? _boom_ ?