```
headers['Access-Control-Allow-Origin'] = '*'
headers['Access-Control-Request-Method'] = '*'
```
Wonder if these needs to be set in the config to make it more secure...