i made a login system app for Atlassian's hipchat/stride that lets you log into client systems with 1 click and i ran into CORS when logging in. I wound up hosting some HTML with the login info int he file cabinet and made it available without login so when you logged in you'd already be on that domain