I wouldn't be so sure, that its a user side issue since CORS is handled on the backend. That is in your server config, explicitly allowing https://secure.hulu.com to access https://www.hulu.com as an example.

That said its likely a bug and nothing nefarious. Not to diminish that this is a really severe issue that you should raise to customer support, who likely has ways of cancelling for you.