using POST to try to trigger CORS OPTIONS request