Updated with CORS "allow all" policy.