Updated for CORS:  Access-Control-Allow-Credentials; Options request bypass auth; echo request Origin.