The browser blocked a response the server sent

• A

  The request never reached the server at all, so it must be getting blocked by a firewall

• B

  The API is rejecting the request because the origin header is missing

• C

  The browser is refusing to hand the response to the page, because the server did not permit that origin

• D

  The two subdomains need to share a TLS certificate to be same-origin