It would surprise me if that was the explanation since this can be easily fixed by Lemmy.world itself by not sending two Accept-Control-Allow-Origin headers, thus breaking web clients.

Right now, I’m forced to route my own calls to my server on the app I’m making because Lemmy.world is misconfigured.

I guess that for instance below 0.18.1, it makes sense, since Lemmy had a bug at that point that didn’t allow web clients to connect.