That's an open question (https://wicg.github.io/cors-rfc1918/#issue-207ba0b9). Feedback welcome!