Contact

Submits to /api/contact on this same origin. Same-origin is the point: it means no CORS preflight and nothing to misconfigure. If this POST turns into an OPTIONS request in the network tab, the API is not actually on this origin.