leave CORS up to CDN should not have to specify yourself