Found out it was really a pre-flight issue. Because we're using a content-type of application/json, it's not a "simple" request. Therefore pre-flight is initiated, but we're not configured correctly for pre-flight. Still up in the air how to do that.