@dmjio says (probably correctly) that it's best to just serve the client from the server and circumvent CORS issues altogether. One day I will set that up. For now, this works... *sigh*