[Grollicus]

Should mention for Access-Control-Allow-Origin that the default value is the safe default and setting this header weakens site security.

[BCharlie]

Great point! I added a sentence to say that the default is all that's needed.