CORS is not just for Ajax