Notes
CORS for desktop app
In dev: each renderer process has its own localhost port. The renderer process passes this in the Origin header for requests, and expects appropriate ACAO headers in the response.
In packaged app: the renderer process does not include Origin header, so expects no extra ACAO headers from the server, otherwise the client would fail to accept responses.