Trying to flesh out CORS / CSRF, especially with AngularJS (not there yet)