API Gateway CORS: no 'Access-Control-Allow-Origin' header
<p>Although CORS has been set up through API Gateway and the <code>Access-Control-Allow-Origin</code> header is set, I still receive the following error when attempting to call the API from AJAX within Chrome:</p>

<blockquote>
  <p>XMLHttpRequest cannot load <a href="http://XXXXX.execute-api.us-west-2.amazonaws.com/beta/YYYYY" rel="noreferrer">http://XXXXX.execute-api.us-west-2.amazonaws.com/beta/YYYYY</a>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 403.</p>
</blockquote>

<p>I attempted to GET the URL through <a href="https://www.getpostman.com/" rel="noreferrer">Postman</a> and it shows the above header is successfully passed:</p>

<p><a href="https://i.stack.imgur.com/cowzz.png" rel="noreferrer"><img src="https://i.stack.imgur.com/cowzz.png" alt="Passed headers"></a></p>

<p>And from the OPTIONS reponse:</p>

<p><a href="https://i.stack.imgur.com/xRCeH.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xRCeH.png" alt="Response headers"></a></p>

<p>How can I call my API from the browser without reverting to JSON-P?</p>