Does CORS security work on the client side response data? The server should still receive the load, right?