`CORS` is an appropriate choice for cross-domain sharing; access must be, however, restricted to authorized domains only,
particularly if `Access-Control-Allow-Credentials` is enabled.

All unauthorized domains must be restricted in addition to domains that allow running untrusted code
like `jsfiddle.com`.
