build 4 URL params for CORS requests