More CORS tweaks