Talk:CORS OriginHeaderScrutiny

what does "protract allowed domain guessing" mean?