CORS universalised