@dangoodin also, same origin policy imposes a lot of limits on how these sorts of services can be interacted with, and rebinding was mainly about bypassing same origin policy.
Cross origin requests are limit to GET and a subset of POST requests which boil down to "requests html forms could make in the early 2000s".