CORS issue when serving from different port or domain.
I have a React app that is being served from a different port (and potentially different domain) than my API server. I am using `koa-passport` to authenticate the user of the API, and I have been able to get a **local** "strategy" working without issue via dev server proxy setting; however, when I attempt to authenticate the user via the **Google OAuth2** strategy, I am running into CORS issues, as follows:

> XMLHttpRequest cannot load https://accounts.google.com/o/oauth2/auth?response_type=code&redirect_uri=h…d=<<SECRET>>.apps.googleusercontent.com. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 405.
(Note that `<<SECRET>>` is used here to mask sensitive info.)

The API server is currently running on port 7000.

I have tried modifying both the `koa` and `node` headers without any success.

One question I have is, does koa-passport (and perhaps passport.js for that matter) use the client req headers for an internal/server side web action that should be considered decoupled from the client?

Anyway, would greatly appreciate any insights here. 😄 