Fixed REST endpoints. Allows for CORS requests.
I was using /new incorrectly. POST requests should be directed to /bombs and /users