Firefox ‘Cross-Origin Request Blocked’ despite headers [closed]

Turns out this has nothing to do with CORS- it was a problem with the security certificate. Misleading errors = 4 hours of headaches.