Do you have the DISCOURSE_ENABLE_CORS in your app.yml as suggests the description?
DISCOURSE_ENABLE_CORS
app.yml