Something I've recently seen more of is people thinking an issue is a CORS issue when in fact it's just an unhealthy service 500ing on the OPTIONS request. I've seen a couple debugging threads get derailed at the start with "this is a CORS issue" because the first person to open a Chrome console scanned and saw "CORS error" on the failed request (I'm guilty of this myself).