CORS stuff removed for internal API