Options work now (cors)