Should mention for Access-Control-Allow-Origin that the default value is the safe default and setting this header weakens site security.