The mistake was putting CORS on the server side. It should have been part of the browser. "Facebook.com wants to access foo.example.com: y/n?"

But then we would have had to educate users, and ad peddlers would have lost revenue.