Google: push security theathe features like CORS to make it hard to run cross domain

Also Google: decides to use single domain so any permission you ever give work for all of their apps