DDoSing who? Doesn't CORS help here?
cors stops the browser from reading the response but the request still gets processed by the server