CORS is a key element of any HTTP-based API. Browsers make a preflight request to the server using HTTP OPTIONS method (that doesn't allow for request body):
GLIS should respond with a valid CORS response.