Browsers can call your functions from any origin; preflight requests are answered for you.
Every response from /functions/v1/ carries Access-Control-Allow-Origin: * and allows the methods GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS and whatever request headers the browser asks for. OPTIONS preflight requests are answered by StitchDB without running your function, so you don't need any CORS code.
CORS headers your function sets itself are replaced by these, so a function can't accidentally break browser access. To restrict who may call a function, require a JWT (Authentication) or check the request in your code.