cross domain requests work, placement of the header stuff is critical