>an afterthought achieved by applying layers and layers of security ducktape This is where you're missing the fundamental nature of the issue in this article.

>an afterthought achieved by applying layers and layers of security ducktape This is where you're missing the fundamental nature of the issue in this article. The sensible security model is there by default. An additional layer is added to make a resource available cross-origin, and the article merely serves to remind people that making a resource available cross-origin is still making it available cross-origin when the origin is localhost.