MDN doesn't say this, do Access-Control-Allow-Methods and Access-Control-Allow-Headers have defaults if you don't return those headers? I.e. would it be sufficient to just have Access-Control-Allow-Origin for static files to be served?
Need it for a documentation thing.