My set up looks much like yours except I'm not using the "AuthorizationScopes:" field. Have you tried deleting the ".aws-sam" folder to make sure you are getting a clean build and deploy? I've had to do that on occasion to get my changes to appear.

If you are getting a 500 error you've at least gotten past CORS going in. Do note that your response needs to include those CORS headers as well or the browser will block it again.

Good luck