CORS middleware with full W3C spec support