`url` shouldn't be settable from CrossOriginResponse objects.