I have two Drupal sites set up. On site A, I'd like to authenticate myself as the currently logged-in user on site B (the remote site) so that I can view and edit nodes on the remote site using the Services module.

The two sites are on different domains, so I'm using the CORS module on the remote site. My CORS config is as follows:

    *|http://MY-SITE-URL|*|Content-Type,X-CSRF-Token,Authentication, Origin, Cookie|true


Calling `user/token` against the remote site gets me a valid X-CSRF-Token. However, when I send the X-CSRF-Token with `system/connect`, the remote server returns the anonymous user. 

I'm trying to authenticate against the remote server with the following code:

    $base_url_api = variable_get('tnb_sync_base_url'); //URL of the remote server
	
    			
    			$options = array(
    			  'headers' => array(
    			    'Content-Type' => 'application/json',
    			  ),
    			  'method' => 'POST',
    			);
    			//Step 1: grab the authentication token from the remote server
    			$response = drupal_http_request($base_url_api . '/user/token', $options);
    			$data = json_decode($response->data);
    				
    			// Check if login was successful
    			if ($response->code == 200) {
    			  // Add the token to the request headers:
    			  $options['headers']['X-CSRF-Token'] = $data->token;
    			  
    			  //Step 2: pass along the token and check who we're logged in as
    			  $response = drupal_http_request($base_url_api . '/system/connect', $options);
    			  $data = json_decode($response->data);
    			  
    			  kpr($response);
    			 
    			  return $options;
    			  
    			}
    			
    			else {
    				return NULL;
    			}


The **response** for the `system/connect` call looks like:

    stdClass Object
    (
        [request] => POST /sync/system/connect HTTP/1.0
    Content-Type: application/json
    X-CSRF-Token: 74xWvd5I5l1ad1WmrIjqZoACo9r7f30YtJx_uCFot_g
    X-NewRelic-ID: VQQAU1JbChACUldTBgUFVw==
    X-NewRelic-Transaction: PxQBVFRUXQJUUVQGVQkFBVIEFB8EBw8RVU4aVA0KA1cCAQxUVQMLUAcAAkNKQQgKVVAEUgEEFTs=
    User-Agent: Drupal (+http://drupal.org/)
    Host: dev.tnb.plus
    Content-Length: 0
    
    
        [data] => {"sessid":"7u8CZ98Gvb1P3ZuKSnK85g2FMkyu8OlqbOp8mnsy7OM","session_name":"SSESS4be586c0dc3085a3ca4f49c7acb4e7d1","user":{"uid":0,"hostname":"2001:4801:7827:0104:be76:4eff:fe11:ccd8","roles":{"1":"anonymous user"},"cache":0,"timestamp":1492095786}}
        [protocol] => HTTP/1.1
        [status_message] => OK
        [headers] => Array
            (
                [date] => Thu, 13 Apr 2017 15:03:06 GMT
                [content-type] => application/json
                [connection] => close
                [set-cookie] => __cfduid=dc62becfa48db03b7f5e40b426d0f587c1492095786; expires=Fri, 13-Apr-18 15:03:06 GMT; path=/; domain=.tnb.plus; HttpOnly
                [access-control-allow-credentials] => true
                [access-control-allow-origin] => http://dan-northern-portal.pantheonsite.io
                [cache-control] => no-cache, must-revalidate
                [expires] => Sun, 19 Nov 1978 05:00:00 GMT
                [surrogate-key] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
                [surrogate-key-raw] => 
                [vary] => Accept-Encoding, Accept
                [x-content-type-options] => nosniff
                [x-drupal-cache] => MISS
                [x-pantheon-endpoint] => a9463df4-67b3-47b9-ad41-148336613222
                [x-pantheon-styx-hostname] => styx94699a92
                [x-styx-req-id] => styx-e58976d158f4a1f2e669efc5205db167
                [x-styx-version] => StyxGo
                [xkey] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
                [x-varnish] => 952125076
                [age] => 0
                [via] => 1.1 varnish-v4
                [server] => cloudflare-nginx
                [cf-ray] => 34ef4f698acf2513-ORD
            )
    
        [code] => 200
    )


How can I properly authenticate myself on the remote site using Services and CORS?