Use https + CORS hosting (from AppFog)