Cs and cors have nothing to do with csrf... Though, yes, neither does same-site