CORS is working with separated front-end/backend-API