CORS enabled, now serving static pages to external sites