>There, now it's secure? ;)

CORS achieved its objective here, because now those requests were coming from your PHP server rather than the user's browser.