Did you just say in Postman in the headers section "password": pass ? Or did you frame it as a specific header?

I'm not sure how helpful this since this is a very old issue but for future reference, anyone can get CORS issues if they are trying to access your store from a localhost. CORS exists in your browser by default and if your app-proxy is deployed to op...