so basically if APIG has enabled CORS one could skip

app.use(
  cors({
    origin: "http://localhost:3000",
    allowedHeaders: ["content-type", ...supertokens.getAllCORSHeaders()],
    credentials: true,
    methods: ["GET", "PUT", "POST", "DELETE", "OPTIONS"],
  }),
)

?