title: CORS request not working when sending authorization headers
body: <p>EDIT: Kevin B answered my question in a comment below. I added some logic to send a 200 request if an OPTIONS http request hit my API to fix the problem. Here is the code:</p>
  
  <pre><code>var allowCrossDomain = function(req, res, next) {
  if ('OPTIONS' == req.method) {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,PATCH,OPTIONS');
    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');
    res.send(200);
  }
  else {
    next();
  }
  };
  
  router.use(allowCrossDomain);
  </code></pre>
  
  <p>Original Question:
  I currently am trying to get an Ionic 2 application running on my localhost to be able to send data to an Express 4 application. It works when I send requests without an authorization header. However, once I added auth headers, my API began to throw errors. I have done my research and have tried to implement what I found here: (<a href="https://stackoverflow.com/a/15254158/5379931">https://stackoverflow.com/a/15254158/5379931</a>.</p>
  
  <p>However, I am getting errors still. If I set Access-Control-Allow-Origin like this: </p>
  
  <pre><code>res.header("Access-Control-Allow-Origin", "http://localhost:8100");
  </code></pre>
  
  <p>I get this error: </p>
  
  <pre><code>XMLHttpRequest cannot load URL. Response to preflight request doesn't pass
  access control check: The 'Access-Control-Allow-Origin' header has a value
  'http://localhost:8100/' that is not equal to the supplied origin. Origin
  'http://localhost:8100' is therefore not allowed access.
  </code></pre>
  
  <p>If I set my Access-Control-Allow-Origin header like this:</p>
  
  <pre><code>res.header("Access-Control-Allow-Origin", "http://localhost:8100/");
  </code></pre>
  
  <p>I get this error:</p>
  
  <pre><code>XMLHttpRequest cannot load URL. No 'Access-Control-Allow-Origin' header is
  present on the requested resource. Origin 'http://localhost:8100' is
  therefore   not allowed access. The response had HTTP status code 400.
  </code></pre>
  
  <p>Here is the rest of my express 4 code that is relevant:</p>
  
  <pre><code>router.use(function(req, res, next) {
      res.header("Access-Control-Allow-Origin", "http://localhost:8100");
      res.header("Access-Control-Allow-Headers", "Origin, Authorization, X-Requested-With, Content-Type, Accept");
      res.header("Access-Control-Allow-Credentials", true);
      res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
      next();
  });
  </code></pre>