You're correct, the browser is the safety net when it comes to CORS.