CORS: proto of CORS authenticated calls