Don't forget about the CORS headers, otherwise web clients can't verify.