.controller
Using basic header to avoid OPTIONS
That's just… not how it works
Assume all responses should be Access-Control-Allow-Origin: *
Correct SW logic
Doh