After enable CORS for /users and /users/{userId} resources, you need to re-deploy the API so the new settings is applied in your dev stage.
/users
/users/{userId}
dev
Resources
UsersAPI
Deploy API
Deploy