The server finally runs the login stuff, but the CORS problem persists