Add requirements, prevent any IP in CORS