Also allow CORS on control endpoints