CORS is configured "properly", meaning insecurly enough for testing purposes. I am able to make an ajax call from the web client to the server! Next step is ironing out the kink in time-formatting.