cors is bad because I can’t use apis but it’s good because we can’t get virus’d by clicking a link