not sending the access control headers by default, send only when the allowed_origins directive is set
Attach a file by drag & drop or click to upload
