Drop "CORS same-origin" from eligibility check.