does this gfycat endpoint not support CORS?

this is unfortunately a huge problem due to Chrome's overzealous permissions dialog.  I'm really, really hesitant to add new domains because what ends up happening is RES gets turned off and chrome users get a big scary (unnecessarily so) warning...

if this endpoint supports CORS, we don't need a permission listed here.