Why browser-based header checks are simulated, what CORS blocks, and how to use the educational demo without mistaking it for a live audit.