This isn't available in any of the libs Kitsune uses or somewhere else? I'm kind of loathe to maintain our own CORS middleware if we don't have to.