After struggling really hard to make a simple proxy in Firebase Functions (see my post), I realized I also needed to enable CORS.
CORS Documentation
Let's take a look at the documentation over at MDN. Apparently, if I want to whitelist any domain, I could set the response header:
Access-Control-Allow-Origin: