title: With respect to client side security, does CORS do anything other than subvert same-origin-policy?
body: <p>(and if not, does it actually improve client side security?)</p>
  
  <p>I'm thinking of the case where a script from server X uses XHR to obtain and run untrusted code from server Y (which supports CORS).</p>
  
  <p>(obviously evaluating untrusted code is bad™)</p>