My Ghost blog, NGiNX CORS config.

security_cors.conf

if ($request_method = "OPTIONS") {
	more_set_headers "Access-Control-Allow-Origin: www.itchy.nl";
	more_set_headers "Access-Control-Allow-Methods: GET, POST, OPTIONS";
	more_set_headers "Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type";
	more_set_headers "Access-Control-Max-Age: 1728000";
	more_set_headers "Content-Type: text/plain charset=UTF-8";
	more_set_headers "Content-Length: 0";
	return 204;
}

if ($request_method = "POST") {
	more_set_headers "Access-Control-Allow-Origin: www.itchy.nl";
	more_set_headers "Access-Control-Allow-Methods: GET, POST, OPTIONS";
	more_set_headers "Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type";

}

if ($request_method = "GET") {
	more_set_headers "Access-Control-Allow-Origin: www.itchy.nl";
	more_set_headers "Access-Control-Allow-Methods: GET, POST, OPTIONS";
	more_set_headers "Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type";
}