Best practice: CORS

[m-mohr]

Should we add a best practice that static catalogs and APIs should be deployed with CORS enabled?
It seems that at least half of the catalogs currently available in STAC Index doesn't send CORS headers and thus I can't use them with STAC browser or any browser-based tooling.