Do Access-Control-Allow-Origin headers override the Mobile Hub Security_AllowOrigin environment poli

Content

I have setup a Mobile Hub, and have created a Custom API that needs to be called from an Ionic mobile client which uses the Oracle Mobile Cloud SDK. The Custom API works without errors when tested within the Backend in Mobile Hub. It looks like this:

module.exports = function(service) {

    service.get('/mobile/custom/patients/patients', function(req, res) {

        req.oracleMobile.connectors.patients.get(null, null, null).then(

            function(result){

                res.setHeader("Access-Control-Allow-Origin", "*");

              res.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");

               res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");

                res.setHeader("Access-Control-Allow-Credentials", "true");

                res.setHeader("Cache-Control", "no-cache");

                res.send