title: Response for preflight 403 forbidden
body: <p>I've been trying to make a simple <code>iron-ajax</code> post to the server, but it keeps failing at the preflight call. For the life of me I can't figure out what's going on, all the CORS headers seem to be correct on the server.</p>
  
  <p><code>Response headers</code></p>
  
  <pre><code>Access-Control-Allow-Credentials:true
  Access-Control-Allow-Headers:Content-Type
  Access-Control-Allow-Methods:GET, POST, PUT, OPTIONS
  Access-Control-Allow-Origin:*
  cache-control:must-revalidate, private, no-cache, no-store, max-age=0
  Connection:Keep-Alive
  Content-Encoding:gzip
  Content-Length:138
  Content-Type:text/html
  </code></pre>
  
  <p><code>Request headers</code></p>
  
  <pre><code>Accept:*/*
  Accept-Encoding:gzip, deflate, sdch, br
  Accept-Language:en-US,en;q=0.8
  Access-Control-Request-Headers:content-type
  Access-Control-Request-Method:POST
  Cache-Control:no-cache
  Connection:keep-alive
  </code></pre>
  
  <p>The request is indeed made from localhost, but I would have thought that the <code>*</code> should take care of that.</p>
  
  <p>Errors that are showing up in the console are: 
  <code>OPTIONS https://... 403 (Forbidden)</code> and </p>
  
  <pre><code>XMLHttpRequest cannot load https://.... Response for preflight has invalid HTTP status code 403
  </code></pre>
  
  <p>Any help/advice is appreciated.</p>