Seems the problem is that the library does not use mode = 'cors' in RequestInit when making fetch requests. Which is why the CORS mechanism does not get triggered
mode = 'cors'
RequestInit