Merge "Reimplement CORS properly, addressing Tim's concerns"