CORS is not that hard and never has been. The real problem is that bank.com keeps hiring developers that think CORS is an obstacle to be overcome instead of a feature that is providing value. As a result CORS keeps getting more complicated in order to break the workarounds of those who thought they got it right the first time while also breaking things for those that actually did.