inlog works, other request don't have CORS headers