Let the web server care about CORS