I also encountered this issue.
The following is my code:
const request = new XMLHttpRequest();
request.open('GET', 'https://api.twitch.tv/kraken/streams/', true)
request.setRequestHeader('client-id', 'my-client-ID')
request.send();
and on the browser console it shows:
Access to XMLHttpRequest at 'https://api.twitch.tv/kraken/streams/' from origin
'null' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header
contains multiple values '*, *', but only one is allowed.