You apparently understand less than me. The little I do understand is that CORS is protection for a site's user, not the site.