primarily because soap services tend to have authentication and work badly with CORS