The problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.