=== Message Make sure this permissive CORS policy is safe here.