title: Getting storage item without CORS configured
body: <p>I fetched an item from my Firebase storage bucket via this technique (generally):</p>
  
  <pre><code>const url = await firebase.storage().ref('my/ref').getDownloadURL();
  const filename = 'filename.ext';
  
  const a = document.getElementById('link');
  a.href = url;
  a.download = filename;
  a.click();
  </code></pre>
  
  <p>I did it the above way prior to trying the example from the docs:</p>
  
  <pre><code>storageRef.child('images/stars.jpg').getDownloadURL().then(function(url) {
    // `url` is the download URL for 'images/stars.jpg'
  
    // This can be downloaded directly:
    var xhr = new XMLHttpRequest();
    xhr.responseType = 'blob';
    xhr.onload = function(event) {
      var blob = xhr.response;
    };
    xhr.open('GET', url);
    xhr.send();
  });
  </code></pre>
  
  <p>When trying it this way, I hit the CORS error. After adding the CORS config to my bucket, it then worked as expected. However, I cannot determine why I was able to successfully fetch it via the first technique prior to configuring CORS. </p>
  
  <p>I tested it again by removing the <code>GET</code> method from my CORS config and uploading the config file again via <code>gsutil</code>. I was still able to successfully obtain the file via the first technique described above.</p>
  
  <p>If this is possible to do without configuring CORS, how can I prevent it to restrict access? Odds are no one will be able to figure out the required ref to build the link, anyways, because the actual ref has multiple unique IDs that will be all but impossible to figure out. This is mainly a question out of curiosity.</p>