Comment by trick-or-treat

I think that once you understand that CORS is about protecting the visitor not the server you're halfway there.

Also, if you have everything set up properly, the fact that you're haveing any CORS issues at all means you're probably trying to do something stupid and you need to ask someone smarter how to solve your problem.