[nelsontky]

Cuz they are supposed to be called by people building various apps, and it does not make sense to limit the source of the network requests

[detaro]

Their API allows CORS requests from everywhere, what do they need to "step up"?