We have to send the Access-Control-Allow-Origin header on a GET ot keep Chrome happy.  That doesn't seem to be what the CORS spec says.