if you're using restlets though, I don't see why CORS is an issue you should be able to just call it w/ the URL and TBA/credentials