Why aren't the url and secure_url parameters returned when CORS is used?

In IE and old browsers, where redirects are used instead of CORS, we're limited in the amount of information we can pass in the callback URL. As an alternative, you can manually build the URL and secure_url in the cloudinarydone callback using the following code:

url = $.cloudinary.url(data.result.public_id, {format: data.result.format, resource_type: data.result.resource_type, type: data.result.type, version: data.result.version, secure: false});
secure_url = $.cloudinary.url(data.result.public_id, {format: data.result.format, resource_type: data.result.resource_type, type: data.result.type, version: data.result.version, secure: true});

You can find more details on which browsers support CORS here: CORS Support