For future reference: the preflight request must return these headers:
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Pragma, Cache-Control
Otherwise, Safari will refuse requests made inside a service worker
reporting a preflight check fail.