ah right, my own brain got jumbled from reading all the comments forgetting that cors: '*' is not the default.