Nice.

Can we just make sure we only have one way of doing CORS? There's some bits floating around elsewhere too.

https://github.com/guardian/frontend/search?q=accessControlAllowOrigin&ref=cmdform