Yandex sat now sends CORS header