> Is the CORS API too complex and confusing

Yes