Looks like it happens on the OPTIONS request
Looks like this was my fault / bug in our code, sorry! I hate cors