Send cache headers in the preflight response so the browser doesn't keep requesting it. > Since it's so easy for developers to circumvent But not for hackers t

Send cache headers in the preflight response so the browser doesn't keep requesting it. > Since it's so easy for developers to circumvent But not for hackers trying to inject JS into insecure webpages. But I do get your point, there should have been a better implementation, I have the same complaint against HTTPS (makes development unnecessarily complicated).