I didn't have to do anything special to allow CORS, and now that I think of it I'm not sure why, because it's been necessary on other SPA projects I've been involved with. Maybe because both servers are localhost. That would be a good thing for me to figure out and include in the post. I'm kind of learning all this in public.