Need to do something like this to serve APIs that are going to be consumed by JS clients.

laravel-cors.php

<?php

App::before(function($request) {
    if ($request->getMethod() == 'OPTIONS') {
        $response = Response::make('', 204);
        $response->header('Access-Control-Allow-Methods', 'GET, POST, PUT, OPTIONS');
        $response->header('Access-Control-Allow-Origin', '*');
        $response->header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization');
        return $response;
    }
});

App::after(function($request, $response) {
    $response->header('Access-Control-Allow-Methods', 'GET, POST, PUT, OPTIONS');
    $response->header('Access-Control-Allow-Origin', '*');
    $response->header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization');
});