But you can't tell it's cross-origin that way, just that it's a browser doing the POST.