No 'Access-Control-Allow-Origin' header is present despite setting DISCOURSE_ENABLE_CORS: true

[xprmnts]

And for our single site setup setting origin in .yml vs. the admin ui should have the same effect per: What is the purpose of Settings -> Security -> CORS origins vs similar environment setting?