I don't want to enable CORs for my entire application, which includes lots of dynamics, APIs, etc. I only want to enable for specific static file extensions (e.g., css, js, fonts, images), and most of these are served by Nginx, so I can't add .htaccess rules either.