title: CORS slim framework. Angular request to apache not working
body: <p>I have a chorme plugin that allows me to toggle CORS by inserting a header. If I use that my slim code works. If not then I get an error as follows.</p>
  
  <blockquote>
    <p>(index):1 XMLHttpRequest cannot load
    <a href="http://localhost/api/flowers" rel="nofollow">http://localhost/api/flowers</a>. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost:9000" rel="nofollow">http://localhost:9000</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>My code</p>
  
  <blockquote>
    <p>$app = new \Slim\Slim();<br>
    $app->response->headers->set('Content-Type', 'application/json'); 
    $app->response->header('Access-Control-Allow-Headers',>
    'Content-Type');
    $app->response->header('Access-Control-Allow-Methods', 'GET, PUT,
    POST, DELETE');<br>
    $app->response->header('Access-Control-Allow-Origin','*');</p>
    
    <p>$app->get('/', function() use($app){</p>
    
    <p>$ins = new Lead();<br>
    $products = $ins->run();<br>
    echo
    json_encode($products);
              });</p>
  </blockquote>
  
  <p>If I use the crome extension then the header response from the server is as follows.</p>
  
  <blockquote>
    <p>HTTP/1.1 200 OK Date: Wed, 16 Dec 2015 23:04:26 GMT Server:
    Apache/2.4.7 (Ubuntu) X-Powered-By: PHP/5.5.9-1ubuntu4.14
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Methods: GET, PUT, POST, DELETE
    Access-Control-Allow-Origin: * Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive Transfer-Encoding: chunked Content-Type:
    application/json</p>
  </blockquote>
  
  <p>So the headers are being sent. But CORS still does not work without the extension. I need to fix this for all browsers of course. Not just mine. I'm pretty sure its a small mistake but I'm not seing it. What's wrong here? </p>