One surprising thing to keep an eye out for is that many web servers do not use the content-type headers when receiving json data; they simply parse the text as json regardless of its stated type and go from there. This means that requests encoded and mime-typed as form data that also parse as json can be sent to servers without triggering a pre-flight request. This can result in CSRF where it's not expected.