CORS is just patch over patch over patch on a terrible idea on how to provide theatre of security