CORS and sundry in preparation for ClientState