yea this also needs to have the access-control-allow-origin header, which is missing..