[cxr]

But that's not a CORS problem. It's a CSP problem. (And CSP deserves to be despised.)