upon successive runtimes for a non-browser client, a valid cookie may be included in an 'options' request for cors access, resulting in a 404 response code