Merge "API: Allow anonymous CORS from anywhere, when specifically requested"