CORS header with script