Do the speakers require the Content-Type header to be set? If not, POST wouldn't require CORS permissions.