Can you add a note on how this interacts with CORS (and why you might not want this to be on)?