- Access-Control-Allow-Headers missed the X-CSFRToken