Merge CORS changes into master.