Getting userinfo creates CORS error after successful login

Thanks James! My app stack exists of a SPA-React app running on port 8888 and a Rails restful api on port 3000. The SPA sends api requests with the JWT token to the Rails app which checks for permissions. Both localhost:3000 and 8888 are in the "Allowed Web Origins " list. So I would expect that it works. Any idea what could be wrong? Thanks Jens.