Add "SameOrigin" policy middleware to the controller routes.