CORS support - very liberal, reconsider for prod