@densetsughem have you solve this issue? I have the same problem
instead of sending
Authorization:anymous
merchant_id:105
merchant_user_id:90
the request still sending Access-Control-Request-Headers & Access-Control-Request-Method
here what is like
Accept:/
Accept-Encoding:gzip, deflate, br
Accept-Language:en-US,en;q=0.9
Access-Control-Request-Headers:authorization,merchant_id,merchant_user_id
Access-Control-Request-Method:GET
Connection:keep-alive
Host:localhost:7070
Origin:http://localhost:8100
User-Agent:Mozilla/5.0 (Linux; Android 5.1.1; Nexus 6 Build/LYZ28E) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.168 Mobile Safari/537.36