diff --git a/backend/go-app/main.go b/backend/go-app/main.go
index bac7e31a..ef607815 100644
--- a/backend/go-app/main.go
+++ b/backend/go-app/main.go
@@ -2159,21 +2159,20 @@ func setUser(ctx context.Context, data *User) error {
 }
 
 func handleCors(resp http.ResponseWriter, request *http.Request) bool {
-
 	// FIXME - this is to handle multiple frontends in test rofl
-	origin := request.Header["Origin"]
-	resp.Header().Set("Vary", "Origin")
-	if len(origin) > 0 {
-		resp.Header().Set("Access-Control-Allow-Origin", origin[0])
-	} else {
-		resp.Header().Set("Access-Control-Allow-Origin", "http://localhost:4201")
-	}
-	//resp.Header().Set("Access-Control-Allow-Origin", "http://localhost:8000")
-	resp.Header().Set("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me")
-	resp.Header().Set("Access-Control-Allow-Methods", "POST, GET, PUT, DELETE")
-	resp.Header().Set("Access-Control-Allow-Credentials", "true")
-
 	if request.Method == "OPTIONS" {
+		origin := request.Header["Origin"]
+		resp.Header().Set("Vary", "Origin")
+		if len(origin) > 0 {
+			resp.Header().Set("Access-Control-Allow-Origin", origin[0])
+		} else {
+			resp.Header().Set("Access-Control-Allow-Origin", "http://localhost:4201")
+		}
+		//resp.Header().Set("Access-Control-Allow-Origin", "http://localhost:8000")
+		resp.Header().Set("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me")
+		resp.Header().Set("Access-Control-Allow-Methods", "POST, GET, PUT, DELETE")
+		resp.Header().Set("Access-Control-Allow-Credentials", "true")
+
 		resp.WriteHeader(200)
 		resp.Write([]byte("OK"))
 		return true