More work on CORS