Syntax for CorsConfiguration string attributes

[imankulov]

As outlined in CorsConfiguration documentation, the sample configuration looks like this.

Resources:
  ApiGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Cors:
        AllowMethods: "'POST, GET'"
        AllowHeaders: "'X-Forwarded-For'"
        AllowOrigin: "'www.example.com'"
        MaxAge: "'600'"
        AllowCredentials: true

With this regard, I have a few questions

1. Should the value for AllowOrigin start with the protocol, i.e., not www.example.com but https://www.example.com?
2. How can I specify that I support multiple origins without resorting to the * fallback?
3. In the example, values are strings that start and end with the ' symbol. What's the purpose of double-escaping them?

[joshbean]

Closing this issue or pull request in advance of archiving this repo. For more information about the decision to archive this repo (and others in the 'awsdocs' org), see the announcement on the AWS News Blog.