SOP certainly does make restrictions on making requests, like setting any non-default headers (including content-type). It is one of the reasons that validating

SOP certainly does make restrictions on making requests, like setting any non-default headers (including content-type). It is one of the reasons that validating content-type to not be one of the normal form values used to be a valid way to handle CSRF for APIs.