问题 为什么浏览器不遵循使用XMLHTTPRequest和CORS的重定向？

我正在使用RESTful API为某些服务编写Web应用程序。该API可在以下网站获得 HTTPS：//api.example 和应用程序在 HTTPS：//app.example。使用CORS的简单GET请求在Chrome和Firefox中运行良好。某些方法通过POST接受数据并使用Location头中的新uri返回303代码。

预检OPTIONS请求很好：

Request Method:OPTIONS
Status Code:200 OK

请求标题

Accept:*/*
Accept-Charset:UTF-8,*;q=0.5
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8,ru;q=0.6
Access-Control-Request-Headers:origin, authorization, content-type
Access-Control-Request-Method:POST
Connection:keep-alive
DNT:1
Host:api.example
Origin:https://app.example
Referer:https://app.example/app/
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.32 (KHTML, like Gecko) Chrome/27.0.1425.0 Safari/537.32 SUSE/27.0.1425.0

响应标题

Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:Authorization, Content-Type
Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
Access-Control-Allow-Origin:https://app.example
Access-Control-Expose-Headers:*
Access-Control-Max-Age:3628800
Connection:keep-alive
Content-Length:0
Date:Sun, 05 May 2013 15:22:50 GMT
Server:nginx/1.2.5

然后实际请求在收到303之后才停止：

Request URL:https://api.example
Request Method:POST
Status Code:HTTP/1.1 303 See Other

响应标头：

Server:nginx/1.2.5
Location:https://api.example/some_url
Date:Sun, 05 May 2013 15:27:49 GMT
Content-Type:application/json
Content-Length:0
Connection:keep-alive
Access-Control-Max-Age:3628800
Access-Control-Expose-Headers:*
Access-Control-Allow-Origin:https://app.example
Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
Access-Control-Allow-Headers:Authorization, Content-Type
Access-Control-Allow-Credentials:true

RFC用户代理应该遵循重定向，但Chrome和FF似乎没有按预期运行。这是浏览器的错误还是我做错了什么？

更新： 如果我用--disable-web-security启动chrome，一切正常。