added fuller reference for CORS policy