braining it back (csp, cors)