The example has adding CORS via the code which is not needed since you are doing it via the API gateway.