diff --git a/server.js b/server.js
index 51db9480cf..6412b78225 100644
--- a/server.js
+++ b/server.js
@@ -22,7 +22,7 @@ process.env.SMTP_SERVICE = conf.get("SMTP_SERVICE");
 process.env.STRIPE_API_KEY = conf.get("STRIPE_API_KEY");
 process.env.STRIPE_PUB_KEY = conf.get("STRIPE_PUB_KEY");
 
-var agent;
+/*var agent;
 if (process.env.NODE_ENV === 'development') {
     // Follow these instructions for profiling / debugging leaks
     // * https://developers.google.com/chrome-developer-tools/docs/heap-profiling
@@ -31,7 +31,7 @@ if (process.env.NODE_ENV === 'development') {
     console.log("To debug memory leaks:" +
         "\n\t(1) Run `kill -SIGUSR2 " + process.pid + "`" +
         "\n\t(2) open http://c4milo.github.com/node-webkit-agent/21.0.1180.57/inspector.html?host=localhost:1337&page=0");
-}
+}*/
 
 process.on('uncaughtException', function (error) {
 
diff --git a/src/server/index.coffee b/src/server/index.coffee
index 8fc29583a8..f09668dee0 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -57,6 +57,7 @@ auth.store(store, habitrpgStore.customAccessControl)
 
 mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
   expressApp
+    .use(middleware.allowCrossDomain)
     .use(express.favicon("#{publicPath}/favicon.ico"))
     # Gzip static files and serve from memory
     .use(gzippo.staticGzip(publicPath, maxAge: ONE_YEAR))
@@ -74,7 +75,6 @@ mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
     )
     # Adds req.getModel method
     .use(store.modelMiddleware())
-    .use(middleware.allowCrossDomain)
     # API should be hit before all other routes
     .use('/api/v1', require('./api').middleware)
     .use(require('./deprecated').middleware)
diff --git a/src/server/middleware.coffee b/src/server/middleware.coffee
index 0a16aad85a..56c6bf16fb 100644
--- a/src/server/middleware.coffee
+++ b/src/server/middleware.coffee
@@ -15,7 +15,12 @@ module.exports.view = (req, res, next) ->
 
 #CORS middleware
 module.exports.allowCrossDomain = (req, res, next) ->
-  res.header "Access-Control-Allow-Origin", '*'
-  res.header "Access-Control-Allow-Methods", "GET,PUT,POST,DELETE"
-  res.header "Access-Control-Allow-Headers", "Content-Type,x-requested-with,x-api-user,x-api-key"
-  next()
\ No newline at end of file
+  console.log req.headers.origin
+  res.header "Access-Control-Allow-Origin", (req.headers.origin || "*")
+  res.header "Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,HEAD,DELETE"
+  res.header "Access-Control-Allow-Headers", "Content-Type,X-Requested-With,x-api-user,x-api-key"
+
+  if req.method is 'OPTIONS'
+    res.send(200);
+  else
+    next()
\ No newline at end of file