diff --git a/cmd/testapi/main.go b/cmd/testapi/main.go
index 1f905b8..1aaafa7 100644
--- a/cmd/testapi/main.go
+++ b/cmd/testapi/main.go
@@ -2,11 +2,11 @@ package main
 
 import (
 	"context"
-	"crypto/rand"
 	"flag"
 	"fmt"
 	"io"
 	"log"
+	"math/rand"
 	"net/http"
 	"os"
 	"os/signal"
@@ -72,6 +72,15 @@ func (s *S) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *S) serveHTTP(w http.ResponseWriter, r *http.Request) error {
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("Access-Control-Allow-Headers", "X-Auth-Token, content-type, Content-Type")
+	if r.Method == http.MethodOptions {
+		w.Header().Set("Content-Length", "0")
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS, TRACE, PATCH, HEAD, DELETE")
+		w.WriteHeader(http.StatusOK)
+		return nil
+	}
 	if isV1(r) || isWS(r) {
 		return s.serveAPI(w, r)
 	}
@@ -177,12 +186,12 @@ func (s *S) serveV1(w http.ResponseWriter, r *http.Request) error {
 	switch r.Method + r.URL.Path {
 	case "GET/v1/state/" + s.Session(ctx).ID:
 		if rand.Int()%2 == 0 {
-			w.Write(`{"name": "foo"}`)
+			w.Write([]byte(`{"name": "foo"}`))
 		} else {
-			w.Write(`{"name": "bar", "party": "party name"}`)
+			w.Write([]byte(`{"name": "bar", "party": "party name"}`))
 		}
 	case "PUT/v1/state/" + s.Session(ctx).ID + "/party":
-		w.Write(`{}`)
+		w.Write([]byte(`{}`))
 	default:
 		http.NotFound(w, r)
 		return nil