POST request to restify with Fetch API not working

Question

I'm having some major problems understanding why the Fetch API won't let me send a POST request to my restify server.

I have a basic restify server with a route that receives POST requests on /login.

This route works perfectly as intended if I test with Postman or HTTPRequester, but when I then test it on a browser application with the fetch API, I get the following error (in Chrome):

OPTIONS http://localhost:1337/login 405 (Method Not Allowed)

Fetch API cannot load http://localhost:1337/login. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 405. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Two issues

1. I specifically use the POSt method in my request, so why suddenly OPTIONS?
2. I've already set Access-Control-Allow-Origin: * on my server.

EDIT: I use restify v5.2.0

My server app:

const restify = require('restify');
const app = restify.createServer({
    'name': 'API Token Test',
    'version': '1.0.0'
});

app.use(restify.plugins.acceptParser(app.acceptable));
app.use(restify.plugins.bodyParser());
app.use(restify.plugins.jsonp());

app.use((req, res, next) => {
	res.header('Access-Control-Allow-Origin', '*');
	res.header('Access-Control-Allow-Headers', 'X-Requested-With');
	return next();
});

app.post('/login', (req, res) => {
    db.execute('SELECT idusers, password FROM users WHERE username = ?', [req.body.username], (selError, rows) => {
        if (passwordHash.verify(req.body.password, rows[0].password)) {
            crypto.randomBytes(256, (err, buf) => {
                if (err) return res.status(500).end();
                else {
                    const token = buf.toString('hex');
                    db.execute('INSERT INTO accesstokens SET userid = ?, token = ?', [rows[0].idusers, token], (insError) => {
                        if (insError) return res.status(500).end();
                        else return res.send({ "AccessToken": token });
                    });
                }
            });
        } else {
            res.status(401).end();
        }
    });
});

app.listen(1337);

(I've left out mysql stuffs and crypto/password-hash -requires, which are irrelevant to the problem)

And my clientside script:

(() => {
    document.addEventListener('DOMContentLoaded', () => {
        const form = document.querySelector('.loginForm');

        form.onsubmit = () => {
            const data = JSON.stringify({
                'username': form.username.value,
                'password': form.password.value
            });

            let headers = new Headers();
            headers.set('Accept', 'application/json');
            headers.set('Content-Type', 'application/json');
            headers.set('Content-Length', data.length);


            fetch('http://localhost:1337/login', {
                'method': 'POST',
                'headers': headers,
                'mode': 'cors',
                'cache': 'default',
                'body': data
            })
                .then((result) => result.json())
                .then((data) => {
                    console.log(data);
                    localStorage.setItem('token', data);
                })
                .catch((err) => {
                    console.log(err);
                });

            return false;
        };
    });
})();

Answer 1

Appears all CORS support has been moved to this module since restify v5.x.

Installing restify-cors-middleware and adding the following to my app worked:

const corsMiddleware = require('restify-cors-middleware');
const cors = corsMiddleware({
    'origins': ['*']
});
app.pre(cors.preflight);
app.use(cors.actual);