A developer uses 'fetch()' in a browser and notices it fails with a CORS error when calling their own API. The API is at 'https://api.example.com' and the frontend is at 'https://app.example.com'. Why does this count as cross-origin?

• A.Origin includes the full domain name and the path of the page, so app.example.com/home and api.example.com/v1 differ, making the browser treat the API call as cross-origin whatever the TLS certificate setting is on the two servers
• B.The Same-Origin Policy compares IP addresses and DNS zones, and two names that resolve to different servers are different origins, so a shared certificate for the wildcard domain does not change the result for fetch calls
• C.The Same-Origin Policy compares the registrable domain and the HTTP method, so GET calls to a subdomain are allowed while POST calls are blocked
• D.The Same-Origin Policy defines origin as scheme + hostname + port. 'api.example.com' and 'app.example.com' have different hostnames, making them different origins regardless of sharing a common root domain