i had the same issue with my own site on github. www redirect caused a 301 redirect and broke cors for me as well. turning off the automatic www redirect seems to have fixed it right away

thanks for finding the fix!