#75 restricting CORS to namespace