@simon I think the CORS doc you linked to recently also included info on cookies