Chrome removes `Access-Control-Allow-Origin` header after downloading the file with `Content-Disposition` header set

Question

I have a web page with audio files which are played via Wavesurfer.js with an option to download the files. Files are stored on a cdn subdomain (e.g. cdn.example.com) so the dow