Very extensive post about CORS. This is fairly complete and shows how quickly it can become complicated.

With the amount of time I spent with this particular beast I have to agree. It can be used well of course, but it's designed in a way that makes it very hard to use properly at all.