The point here is that if you put a proxy in front of your API, on your own infrastructure, _you are no longer in origin scope_ and cookies will not be sent along with the request.