CORS for scripts