so these are the configuration options the CORS module gives us:

> A list of paths and corresponding domains to enable for CORS. Multiple entries should be separated by a comma. Enter one value per line separated by a pipe, in this order:
- Internal path
- Access-Control-Allow-Origin. Use <mirror> to echo back the Origin header.
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- Access-Control-Allow-Credentials