Frequently people install MediaViewer but can't get it to work due to bad CORS configuration (e.g. T194459, T188178). Either the requirement to configure headers should be documented very clearly, or MediaViewer should not require CORS to work. (It's currently used for two things: performance analytics, which is relevant to a vanishingly small fraction of third-party users, and AJAX preloading, which could be replaced by plain <img>-based preloading at the cost of the loading bar becoming less useful, which should be acceptable as it's already not very useful.)