WebSocket API blocked by CORS policy ONLY for /calendars/

I’m successfully using the JavaScript/HTML WebSocket connection to view and control my devices. Unfortunately, there doesn’t appear to be an API to retrieve my next two week’s worth of calendar entries (the calendar entity only lists the next, single event). I’d love if that API was exposed.

Because of the missing JavasScript API I’m using the REST API:
http://<my_local_hass_ip>:8123/api/calendars/calendar.contacts?start=2020-10-13T07:00:00.000Z&end=2020-10-26T07:59:59.999Z

Unfortunately the above line throws the error:
“… has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.”

I’ve set up my http cors_allowed_origins properly because these two REST API’s are successful:
http://<my_local_hass_ip>:8123/api/ ==> {message: “API running.”}
http://<my_local_hass_ip>:8123/api/states/light.office ==> {entity_id:“xxx”, state:“on”,…}

Only the /calendars/ path throws the CORS policy issue from JavaScript, although it passes using Postman or CURL. Community thoughts on any way to access two weeks worth of calendar entries? I’m stumped.