Token post.
Allow CORS.