Functional after server-side CORS authorization