diff --git a/api/config.go b/api/config.go
index <HASH>..<HASH> 100644
--- a/api/config.go
+++ b/api/config.go
@@ -3,6 +3,7 @@ package api
 import (
 	"flag"
 	"net"
+	"net/http"
 	"net/http/httputil"
 	"net/url"
 
@@ -58,4 +59,11 @@ func ConfigProcess() {
 		log.Fatal(4, "API Cannot parse fallback-graphite-addr: %s", err)
 	}
 	graphiteProxy = httputil.NewSingleHostReverseProxy(u)
+	// remove these headers from upstream
+	// we will set our own correct ones (and duplicate headers are illegal)
+	graphiteProxy.ModifyResponse = func(resp *http.Response) error {
+		resp.Header.Del("access-control-allow-credentials")
+		resp.Header.Del("Access-Control-Allow-Origin")
+		return nil
+	}
 }
fix duplicate access control headers leading to browser blocking
requests

we can now successfully use MT directly from browser, with dynamic
proxying!