Chrome dev channel didn't want to send the notification without this. I haven't tried it in other browsers to see if it makes a difference, but my reading of CORS indicates that they all will require it eventually.