Mastodon devs admit some endpoints should be CORS enabled, and did so. Whatever you do to make this fact "fit" your logic should be extended to the other endpoints. Glitch already extended it.