Алексей Вардугин

поставь https://github.com/barryvdh/laravel-cors

или поправь свой middleware:

public function handle($request, Closure $next)
{
      $response = $next($request);

      if ($response instanceof Response) {
          $response->headers->add([
              'Access-Control-Allow-Origin' => '*',
              'Access-Control-Allow-Headers' => 'authorization, allow',
              'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE, OPTIONS'
          ]);
      }

      return $response;
}

В App\Http\Middleware\VerifyCsrfToken пропиши:
protected $except = [
'api/*'
];

https://laravel.com/docs/5.4/csrf