The header is a CORS header enforced by the browser, it is independent from the server’s response code (200). The page would need to have CORS enabling headers for you to be able to perform that request in the browser.
Ah, I see.
Getting slightly off topic now and I don't know if you're informed on this at all but do you have any info on why filtering hasn't been implemented?
It's been 6+ years now and aside from the ?exclude= thing people have consistently asked about it pretty much every year since. Does the backend just not support it? Is it low priority?