Websocket connections don't enforce CORS. So that's another alternative - host all of you APIs via websockets.