ASP.NET Core and CORS Gotchas

calls failed and upon closer inspection it was due to the fact that the CORS headers weren't getting sent