CORS docs and CSP docs are so impenetrable unless you already have a relatively decent understanding of whats going on.