In our serverless app, we have added the following to the resources block of serverless.yml so that 4xx and 5xx error responses have CORS headers.