CORS was allowed (added more headers).