Why aren't the `url` and `secure_url` parameters returned when CORS is used?

In IE and old browsers, where redirects are used instead of CORS, we're limited in the amount of information we can pass in the callback URL. As an alternative, you can manually build the 'url' and 'secure_url' in the 'cloudinarydone' callback using the following code:

url = $.cloudinary.url(data.result.public_id, {format: data.result.format, resource_type: data.result.resource_type, type: data.result.type, version: data.result.version, secure: false});
secure_url = $.cloudinary.url(data.result.public_id, {format: data.result.format, resource_type: data.result.resource_type, type: data.result.type, version: data.result.version, secure: true});

You can find more details on which browsers support CORS here: CORS Support