CORS preflight response doesn't match actual response

OK I figured it out... Apollo Server was overriding the cors settings. Add 'cors: false' to .applyMiddleware removes the override. See https://www.apollographql.com/docs/apollo-server/api/apollo-server.html#Parameters-2 and https://github.com/expressjs/cors/issues/134#issuecomment-413543241 for more details