Flask WTF CSRF with CORS

cors_session.html

<!-- executing from http://localhost.localdomain:63342 -->
<script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>
<script>
    $.ajax({
        url: 'http://localhost.localdomain:5000/',
        xhrFields: {
            withCredentials: true
        },
        success: function (data) {
            $.post({
                url: 'http://localhost.localdomain:5000/',
                headers: {
                    'X-CSRFToken': data.csrf_token
                },
                xhrFields: {
                    withCredentials: true
                }
            });
        }
    });
</script>

cors_session.py

from flask import Flask, jsonify
from flask import session
from flask_wtf.csrf import generate_csrf, CsrfProtect

app = Flask(__name__)
app.secret_key = 'dev'
csrf = CsrfProtect(app)

@app.after_request
def add_cors(rv):
    rv.headers.add('Access-Control-Allow-Origin', 'http://localhost.localdomain:63342')
    rv.headers.add('Access-Control-Allow-Headers', 'X-CSRFToken')
    rv.headers.add('Access-Control-Allow-Credentials', 'true')
    return rv

@app.route('/', methods=['GET', 'POST'])
def index():
    print(session)
    csrf_token = generate_csrf()
    return jsonify(csrf_token=csrf_token)

if __name__ == '__main__':
    app.run('localhost.localdomain', use_reloader=True)