Follow
type of guy who doesn't set access-control-allow-origin to the wildcard for publicly available information
the purpose of CORS is to make sure things which are only on the intranet stay only on the intranet and things which require credentials keep requiring credentials. if your thing doesn't fit either of those cases please just let people use scripts with them
type of guy who doesn't set access-control-allow-origin to the wildcard on a publicly-accessible redirect to a page with access-control-allow-origin set to the wildcard