This looks to me like we only consider a browser to support CORS if it supports ActiveX. That's not right, is it?