CORS works for posting from smokescreen app