Comment by kentonv

> We disable the CORS headers specifically for the OAuth API

Oops, I meant we set the CORS headers, to disable CORS rules. (Probably obvious in context but...)