Separating two filters, one for api_key, one for the CORS option.