Use route-specific CORS