diff --git a/lib/Kalamar.pm b/lib/Kalamar.pm
index 6a6a7cf..8efd919 100644
--- a/lib/Kalamar.pm
+++ b/lib/Kalamar.pm
@@ -110,7 +110,12 @@
 
   $self->hook(
     before_dispatch => sub {
-      shift->res->headers->header('X-Content-Type-Options' => 'nosniff');
+      my $h = shift->res->headers;
+      $h->header('X-Content-Type-Options' => 'nosniff');
+      $h->header(
+        'Access-Control-Allow-Methods' =>
+          $h->header('Access-Control-Allow-Methods') // 'GET, POST, OPTIONS'
+        );
     }
   );
 
@@ -161,6 +166,7 @@
     'default-src' => 'self',
     'style-src' => ['self','unsafe-inline'],
     'script-src' => 'self',
+    'connect-src' => 'self',
     'frame-src' => '*',
     'media-src' => 'none',
     'object-src' => 'self',