Or just declare JSON as text, simple cors supports authentication, no need to mess with routes.