Yeah, hmm, we allow XHR CORS to modify the headers, presumably including "Accept"