When using the "Samsung internet" browser on an Android device, it fails to do Ajax (some work) requests. After some debugging I saw that the browser only sends the options request (which succeeds) but does not send the corresponding post request afterwards.
You can try yourself by visiting my Dev site, select ok on the confirm prompt, click on login and try to login with random data
As mentioned in the comments, it seems like the Samsung internet browser doesn't handle wildcard access-control headers.
So I need to switch to an explicit list...