diff --git a/src/server/index.coffee b/src/server/index.coffee
index 8fc29583a8..f09668dee0 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -57,6 +57,7 @@ auth.store(store, habitrpgStore.customAccessControl)
 
 mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
   expressApp
+    .use(middleware.allowCrossDomain)
     .use(express.favicon("#{publicPath}/favicon.ico"))
     # Gzip static files and serve from memory
     .use(gzippo.staticGzip(publicPath, maxAge: ONE_YEAR))
@@ -74,7 +75,6 @@ mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
     )
     # Adds req.getModel method
     .use(store.modelMiddleware())
-    .use(middleware.allowCrossDomain)
     # API should be hit before all other routes
     .use('/api/v1', require('./api').middleware)
     .use(require('./deprecated').middleware)
diff --git a/src/server/middleware.coffee b/src/server/middleware.coffee
index 902b8f3ec4..56c6bf16fb 100644
--- a/src/server/middleware.coffee
+++ b/src/server/middleware.coffee
@@ -17,6 +17,10 @@ module.exports.view = (req, res, next) ->
 module.exports.allowCrossDomain = (req, res, next) ->
   console.log req.headers.origin
   res.header "Access-Control-Allow-Origin", (req.headers.origin || "*")
-  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,PUT,POST,DELETE"
-  res.header "Access-Control-Allow-Headers", "Content-Type,x-requested-with,x-api-user,x-api-key"
-  next()
\ No newline at end of file
+  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,HEAD,DELETE"
+  res.header "Access-Control-Allow-Headers", "Content-Type,X-Requested-With,x-api-user,x-api-key"
+
+  if req.method is 'OPTIONS'
+    res.send(200);
+  else
+    next()
\ No newline at end of file