Are you trying to make authenticated requests to the itch.io domain? That isn't allowed. Could you tell me what you're trying to accomplish?
Thanks
I think you have it backwards, it doesn't make sense to add CORS to itch.io since you wouldn't be making requests there. We don't have a server running on our domain that would know how to respond to your request. If you want to have your game communicate with your own domain you would want to add CORS to your domain