Validate cookie in guardian

I’m not sure if this is the cause of your difficulties, but it’s possible this is causing CORS weirdness since the two hostnames don’t agree. :thinking: