Allow options requests so CORS can succeed
Use secretkey instead