Use POST /passwords instead of PUT /passwords to prevent preflight CORS-request which was blocking the request since no Access-Control-Allow-Origin header was sent on OPTIONS request