Since most sites are non-CORS, trying CORS and then falling back to proxy would impose too much of an overhead for the common case.