Not setting crossOrigin at all, unless request