Consider supporting HTTPS, since a lot of the un-cors'ed javascript this service enables involve credentials.