CORS errors after enabling CORS as recommended

[impactmass]

Describe the bug
According to documentation (here and here), Hydra supports CORS; but while implementing reactioncommerce/example-storefront#350, it was found that the recommended steps did not work. CORS related errors were still happening.

A work-around was used to prevent stalling the ticket, so this issue exists to (1) investigate more about the exact cause of the errors, (2) Re-open discussion with the software creators (as it was once reported here)

To Reproduce
Steps to reproduce the behavior:

1. Enable CORS in Hydra instance as recommended in the link above
2. Call Hydra's /oauth2/token from browser
3. Notice the CORS related errors
   See Enable access token refreshing example-storefront#350 for more steps

Expected behavior
No errors after enabling as recommended