More on CORS, enabling across the board for once