Allow Content-Type for CORS request, it's basically required :)