403 “Not a valid CORS request.”

[frqnck]

It is (probably) not strictly correct for the CORS plugin to return a 403 “Not a valid CORS request.”.
The Web browser really should make that decision rather than the API?
Although, this 403 is currently serving us well and may deter the ‘scrapping’ kids…

TODO: Check against https://www.w3.org/TR/cors/

Maybe make this an optional feature?

Somehow that 403 may affect JSONP request, legacy browser probably don’t follow same origin policy anyway. Currently, JSONP requests require to disable the CORS plugin (using the _no_cors param).