Comment by bjohnso5

Quick suggestion: rather than having your headers return 'Access-Control-Allow-Origin' '*';, you're better off echoing the requesting domain back, so that in the future you'll be able to maintain a whitelist of registered domains. Prevents usage from any-old-domain (though I realize you have authorization already built into some parts of your API).