add Location header to Expose list for CORS
Disablr csrf filter on server side https://github.com/shevalex/asktheworld/issues/11