title: CORS error on Owin Self Host WebApi2
body: <p>I have a WebApi2 OWIN SelfHost application and a REST method. I made a JQuery ajax call to the service but I get the error "No 'Access-Control-Allow-Origin'", se below: </p>
  
  <p>I have added the Nuget package "Microsoft.Owin.Cors" in order to anable cors.</p>
  
  <p>Here is my startup API code:</p>
  
  <pre><code>app.Map("/api", apiApp =&gt;
  {
      var config = new HttpConfiguration();
      config.MapHttpAttributeRoutes();
      apiApp.UseWebApi(config);
      apiApp.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
  });
  </code></pre>
  
  <p>My API Controller class:</p>
  
  <pre><code>[RoutePrefix("car")]
  [AllowAnonymous]
  public class CarController : ApiController
  </code></pre>
  
  <p>My API Controller method:</p>
  
  <pre><code>[HttpGet]
  [Route("get/{id}")]
  public HttpResponseMessage Get(string id)
  {
      var car = GetCars().Where(c =&gt; c.Id.Equals(id)).FirstOrDefault();
      return new HttpResponseMessage(HttpStatusCode.OK)
      {
          Content = new ObjectContent&lt;object&gt;(new
          {
              car
          }, Configuration.Formatters.JsonFormatter)
      };
  }
  </code></pre>
  
  <p>Here is my ajax code:</p>
  
  <pre><code>$.ajax({
      type: "GET",
      url: 'url.../api/car/get/6975908',
      headers: {
          'Access-Control-Allow-Origin': '*',         
          "X-Requested-With": "XMLHttpRequest"
      },
      crossDomain: true,
      dataType: 'json',
      success: function (data) {
          if (data.Success) {
              alert(data.Content); //display success 
          }
          else {
              alert(data.Message) //display exception
          }
  
      },
      error: function (XMLHttpRequest, textStatus, errorThrown) {
          alert(textStatus);
      }
  });
  </code></pre>
  
  <p>Error message:
  "Failed to load resource: the server responded with a status of 405 (Method Not Allowed) url.../api/car/get/6975908
  XMLHttpRequest cannot load url.../api/car/get/6975908. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'url...:62456' is therefore not allowed access."</p>
  
  <p>I only need to enable CORS at this point, and dont need to Authorize, I have set the [AllowAnonymous] attribute on the controller. What might be the problem?</p>