Turns out this has nothing to do with CORS- it was a problem with the security certificate. Misleading errors = 4 hours of headaches.
2.1m questions
2.1m answers
60 comments
57.0k users