CORS, laravel and POST'ing data - laravel

Question

I'm writing a vue app to post data using axios to an API powered by laravel. The APIhas a POST route which is to create a resource. I have CORS set up which allows successful GET'ing of the data. However when I try to POST the data, the network tab shows an OPTIONS request being made with nothing being returned and no POST request follows.
Using axios: a POST request is made with: axios.post(url);
but no POST request is actually made, only the OPTIONS request with: axios.post(url,data).
I made a simple api with slim and didn't have similar problems, so I'm assuming this is something laravel specific?
There are no server log errors, the laravel log shows no errors neither. The error in the browser console is: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://api/api/zones/save. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
UPDATE
These are the headers that are sent as the request:
Host: apiurl
User-Agent: ....
Accept: text/html,application/xhtml+xm…plication/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin:null
DNT: 1
Connection: keep-alive
I understand about the pre-flight but the API I made with slim passed the pre-flight using the same axios code and the post request was made. I'm not sure why the laravel API isn't doing so.
UPDATE 2
These are the headers for the OPTIONS response
Server nginx/1.10.3 (Ubuntu)
Content-Type text/html; charset=UTF-8
Transfer-Encoding chunked
Connection keep-alive
Allow GET,HEAD,POST
Cache-Control no-cache, private
Date Fri, 03 Nov 2017 20:46:47 GMT
Content-Encoding gzip
and this is the code I'm using for the laravel middleware:
public function handle($request, Closure $next)
{
return $next($request)
->header('Access-Control-Allow-Origin', '*')
->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
->header('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization')
;
}
}
I'm including this code in the Kernel under the 'api' key