CORS policy

Clearly stated… make sure you read it…