Why authenticate request returned 403 after successful login?
Try to be specific with the ACAO header, like
Access-Control-Allow-Origin: admin.example.com

The wildcard is not really appreciated, browsers may treat this as high security risk and block the request.