CORS for private networks