CORS simplifies building Office 365 SPAs. If you're however building multi-tenant applications on a stack without an SDK, there are a few things that you have to take care of.