TEMP: disable CORS when using CDN