commonform-js from GitHub
allow Authorization CORS header