Only allow CORS for /public