browsers refuse to POST, they OPTIONS instead. So now it's a GET