CORS policy not enforced

AFAICT my CORS policy is not enforced by ESP. I'm following the [CORS Support documentation](https://cloud.google.com/endpoints/docs/grpc/specify-esp-v2-startup-options#cors).

The documentation provides the following example for the `cors_allow_origin_regex` flag
```
^https?://.+\.example\.com$
```

The `.+` part means this pattern only matches
- http://www.example.com
- https://www.example.com

...but NOT
- http://example.com
- https://example.com

Updating the regex to include the missing URLs
```
^https?://(www\.)?example.com$
```

The [documentation](https://cloud.google.com/endpoints/docs/grpc/specify-esp-v2-startup-options#cors) also states that when this option is set in a Kubernetes configuration file, an additional backslash character must be added to escape instances of `\`
```
^https?://(www\\.)?example.com$
```

The final set of cors-related ESP args declared in my Kubernetes configuration file (YAML)

```yaml
args: [
"--cors_preset=cors_with_regex",
"--cors_allow_origin_regex=^https?://(www\\.)?example.com$",
"--cors_allow_headers=DNT,User-Agent,X-User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,X-Recaptcha-Token",
]
```

However, when hitting the endpoint with `curl`, I the request works
```
curl -X POST https://api.example.com/foo?key=
```

I tested this in a real GCP project and checked the configuration deployed to GKE (note, I changed the URL to example.com, but that's all)


Surely the `curl` request should fail since it's not from one the allow origins?