You're right, I forgot that form requests bypass the preflight.