It makes CORS requests to the server to get resources, such as some partial html files. Each request gets intercepted by the AD login pipeline. But it appears that each request is now being 302'd from a login page at