CORS security problems need to fix