Why Does Pre-flight Request Not Return CORS Headers?

Questions
2

According to the docs, you need to redirect to the /authorize endpoint

Note: When making requests to the /authorize endpoint, the browser (user agent) should be redirected to the endpoint. You can’t use AJAX with this endpoint.