Ratchet down CORS allowances.