note on CORS, multiple domains