CORS

  app.all('*', function (req, res, next) {

    res.header("Access-Control-Allow-Origin", req.headers.origin);
    res.header("Access-Control-Allow-Credentials", true);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
    res.header("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, Authorization, Content-Length");

    if (req.method == 'OPTIONS') {
      return res.send(200);
    }

    return next();
  });