The requirement for this CORS configuration isn't mentioned in the original JIRA. Could you add explanation either there or here of why it needed to be added, and also how it differs from the CORS functionality which we merged and tested yesterday as part of https://github.com/GPII/universal/pull/180 - Thanks