switched the API from using CORS to JSONP for the cross-domain requests. Login is working over ajax now