CORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers should always do that but then

CORS seems like a nice-to-have. You're relying on other software to always indicate something is a cross origin request, browsers should always do that but then there is a whole host of software that uses embedded web controls and the like and may navigate to webpages on the basis of external and not user input.