Rename cors.OriginPermission model to cors.Origin
Protect against no 'url' field in dataset JSON (should only happen in tests, if ever)