title: Angular 2/4 and Jersey REST CORS issue
body: <p>I've been trying to build relatively simple app with angular and jersey REST on the back end. I've managed to make some communication between the two but when I try to implement security as by following this answer <a href="https://stackoverflow.com/questions/26777083/best-practice-for-rest-token-based-authentication-with-jax-rs-and-jersey">Best practice for REST token-based authentication with JAX-RS and Jersey</a> I get some strange behaviour. </p>
  
  <p>When I try to make a POST request from Angular app (localhost:4200) I get 403 Forbidden (Response to preflight request doesn't pass access control check) without even executing ContainerRequestFilter or ContainerResponseFilter.</p>
  
  <p>When I send exactly the same request with POSTMAN everything works fine. Every filter gets called and authentication works fine.</p>
  
  <p>Here are my classes:</p>
  
  <pre><code>@Provider
  public class CorsFilter implements ContainerResponseFilter {
  
  @Override
  public void filter(ContainerRequestContext request,
          ContainerResponseContext response) throws IOException {
  
      System.out.println("cors");
      response.getHeaders().add("Access-Control-Allow-Origin", "*");
      response.getHeaders().add("Access-Control-Allow-Headers",
              "origin, content-type, accept, authorization");
      response.getHeaders().add("Access-Control-Allow-Credentials", "true");
      response.getHeaders().add("Access-Control-Allow-Methods",
              "GET, POST, PUT, DELETE, OPTIONS, HEAD");
      System.out.println(response.getHeaders());
  }
  </code></pre>
  
  <p>REST </p>
  
  <pre><code>@Path("/like")
  @POST
  @Secured({User.RoleEnum.ADMIN,User.RoleEnum.MODERATOR,User.RoleEnum.SUBSCRIBER})
  @Consumes(MediaType.APPLICATION_JSON)
  @Produces(MediaType.APPLICATION_JSON)
  public Response like(Comment toUpdate){
      System.out.println("like");
      Comment updated = null;
      try {
          updated = commentService.like(toUpdate);
      } catch (IOException e) {
          // TODO Auto-generated catch block
          return Response
                  .serverError()
                  .build();
      }
      if(updated !=null){
          return Response
                  .ok(updated)
                  .build();
      }
      return Response
              .noContent()
              .build();
  }
  </code></pre>
  
  <p>@Secure interface, AuthorizationFilter and AuthenticationFilter are basically the same as the link I posted above. </p>
  
  <p>Angular request</p>
  
  <pre><code>const headersAuth = new Headers({'Content-Type': 'application/json', 'Authorization': 'Bearer ' + this.userService.loggedUserToken});
  return this.http.post(this.url + this.likeURL, comment, {headers: headersAuth})
    .map(
      (res: Response) =&gt; {
        const body: CommentModel = res.json();
        return body || {};
      }
    )
    .catch(this.handleError);
  </code></pre>
  
  <p>}</p>
  
  <p>Please have in mind that exactly the same headers and content sent via postman app to the resource, works fine but when I try to send it via Angular POST I get 403 forbidden without even triggering the filters. Also it works when I remove @Secure and Authorization header from Angular</p>