Even more liberal CORS policy