According to your link, if I see "access-control-allow-origin: *" in the headers it should work... and I do. So I don't think that's the problem.
I reproduced the problem with developer tools open, and I don't even see any requests to QOTO showing up in the log. My guess is that Pinafore creates a malformed request that the browser never even sends correctly.
@khird oh okay, thanks, I'll open an issue on github