CORS fixed for real