Yes the CORS threat model was also reversed for me. Couldn't understand it. Eventually I got it...