Simple 'work-around': Not setting CORS headers (for now).  :-( :-(