I'm slightly surprised that the CORS policy wasn't just "*" considering how wide open the server itself was.