I’m pretty sure the response headers are generated by the web server. I don’t think digital.gov is running hugo as a server, so you’ll need to consult the web server’s response header settings.
As @maiki suggests this issue is on your server setup. You can go down the server config path setting the CORS headers, you can use a reverse proxy to serve the api on the same domain, port and scheme, or, if the api is on a subdomain, there’s also this one trick.
That is a helpful clarification. Thank you! I will check with the Federalist team https://federalist.18f.gov/ to see how headers are being sent on upload to S3.