Comment by Raqbit

This is also the reason you can still POST text/plain to random TCP servers on the user's local network, without pre-flight check.