If you took your experiment in non-incognito mode before you set the right CORS configuration, your browser might have remembered that the requests failed and not bothered sending them again. Clearing the cache made it send new requests, which were successful now that you have updated the CORS settings
Jeremy