A POST to the charge endpoint is not actually a simple request according to
the CORS spec but this demonstrates that the CORS middleware at least fits in
place.

The next step is to replace simpleCors with a policy that's compatible with
use of our endpoint.