title: CORS error - my headers
body: <p>I have attempted to do my homework before asking this question but I cannot see what is missing in my headers.</p>
  
  <p>I set the following headers in the javascript:</p>
  
  <pre><code>xhr.setRequestHeader('Access-Control-Allow-Headers', 'Origin, Accept, Content-Type, Access-Control-Allow-Origin');
  xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
  xhr.setRequestHeader('Access-Control-Allow-Methods', 'GET,POST');
  xhr.setRequestHeader('Content-Type', 'application/json');
  </code></pre>
  
  <p>The server sends the headers with the response:</p>
  
  <pre><code>Pragma: no-cache
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: PUT, GET, POST, OPTIONS
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
  Access-Control-Max-Age: 86400
  Transfer-Encoding: chunked
  Cache-Control: no-store, must-revalidate, no-cache, post-check=0, pre-check=0
  Date: Wed, 15 Mar 2017 03:39:49 GMT
  Set-Cookie: PHPSESSID=1ng3l10lvrrovlmdbij5chv2f5; path=/
  Server: Apache
  Content-Type: application/json
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  </code></pre>
  
  <p>Yet I get the error in my browsers(FF &amp; Chrome): </p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="http://api.mydomain.com/login" rel="nofollow noreferrer">http://api.mydomain.com/login</a>. (Reason: missing token ‘access-control-allow-headers’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel).</p>
  </blockquote>
  
  <p>Can anyone see what I am missing?</p>