Sort:  

No, those are actually meant to be available like this, without any extra headers there

Okay. That's okay. Certain browsers can be made to disable CORS for us devs who are testing our software.