Just something to note.

Websocket connections don't enforce CORS. So that's another alternative - host all of you APIs via websockets.