Comment by The_Amp_Walrus

is there an implicit assumption that we're operating on the same domain here for the frontend and backend

I'm not sure that it's so easily handled if you're working from www.foo.com and api.foo.com