Be explicit about allowing cross origin access and which headers are allowed / required.
Be explicit about allowing cross origin access and which headers are allowed / required.
Add special encoding for encrypted token so that it doesn't break in browsers.   It's a bit more involved than simple URL encoding.