Failed Fetch API in Safari due to access control checks

### Discussed in https://github.com/orgs/supabase/discussions/19983 <div type='discussions-op-text'> ^{Originally posted by **asyncink** December 23, 2023} Hello! We are facing errors in Safari which are not reproduced in 100% cases, but are definitely on Supabase side and are reproduced consistently in Safari browser. Safari makes preflight request (OPTIONS) when interacting with Supabase API. And for some reason, that we can not clearly figure out on our side, these requests are failed with following errors to the browser console. Fetch fails when fetching rows from database or during authentication (actually any Supabase APIs are affected). ``` Fetch API cannot load https://jhfjkcfjxvjlvipwubnk.supabase.co/rest/v1/orders?select=*&order=creationDate.desc due to access control checks. ``` ``` Fetch API cannot load https://jhfjkcfjxvjlvipwubnk.supabase.co/auth/v1/token?grant_type=password due to access control checks. ``` And even logout fails: ``` Fetch API cannot load https://jhfjkcfjxvjlvipwubnk.supabase.co/auth/v1/logout?scope=global due to access control checks. ``` We can see these request in Supabase logs and they have status 200 OK, but we suppose that reason is in inappropriate response headers. ``` OPTIONS \| 200 \| 62.217.185.59 \| 839c5ef3cf951640 \| https://jhfjkcfjxvjlvipwubnk.supabase.co/rest/v1/orders?select=*&order=creationDate.desc \| Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15,"[{"cf":[{"asOrganization":"Lovitel","asn":41275,"botManagement":[{"corporateProxy":false,"detectionIds":[],"ja3Hash":null,"jsDetection":[{"passed":false}],"score":99,"staticResource":false,"verifiedBot":false}],"city":"Moscow","clientAcceptEncoding":"gzip, deflate, br","clientTcpRtt":null,"clientTrustScore":null,"colo":"DME","continent":"EU","country":"RU","edgeRequestKeepAliveStatus":1,"httpProtocol":"HTTP/3","isEUCountry":null,"latitude":"55.74830","longitude":"37.61710","metroCode":null,"…