user-configured third-party CORS -> discussion