nginx.conf

            if ($request_method = OPTIONS) {
                # Handle OPTIONS method
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 204;
            }

            # Headers get added no matter the request method
            more_set_headers "Access-Control-Allow-Credentials: true";
            more_set_headers "Access-Control-Allow-Methods: GET, POST, PUT, DELETE";
            more_set_headers "Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Api-Password";
            more_set_headers "Access-Control-Allow-Origin: $allowed_origin";
            more_set_headers "Access-Control-Max-Age: 600";
            more_set_headers "Vary: Origin";