why is everything I ever want to do in the browser a violation of CORS