API: Allow anonymous CORS from anywhere, when specifically requested