slightly better CORS checks