tl;dr<p>never use<p><pre><code>       Access Control Allow Origin: * 
</code></pre>
and never simply repeat the requesting origin back in the access control<p>both rules seems kind of obvious to me but apparently not to everyone