Set CORS header so this actually works :)
Add comment sbout Access-Control-Request-Headers