“If you are logged in to a site that does this, it&#x27;s a huge danger. Your private account information can be slurped down by ajax on any other sites.”<p>This is false (unless `Access-Control-Allow-Credentials` is set). See CORS 101: <a href="https:&#x2F;&#x2F;annevankesteren.nl&#x2F;2012&#x2F;12&#x2F;cors-101" rel="nofollow">https:&#x2F;&#x2F;annevankesteren.nl&#x2F;2012&#x2F;12&#x2F;cors-101</a>