CORS and caches explained