CORS support (work in progress)