Stop allowing credentialed cross-origin requests (closes #261)

CORS() allowed every origin with credentials, so a page on another
origin of the same site could read what the signed-in user sees. It
now uses the options of the CONVENTIONS.md template: every origin as
*, no credentials, and the template's request headers. corsMaxAge
stays, since AGENTS.md asks for named constants.

Model: opus-5-5

internal/server/server_test.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"strconv"
 	"strings"
 	"testing"
@@ -188,6 +189,62 @@ func TestServeAfterStopDoesNotStopApp(t *testing.T) {
 	}
 }
 
+// TestCORSAllowsAnyOriginWithoutCredentials checks that the
+// responses to a request from another origin and to a preflight
+// both carry Access-Control-Allow-Origin: *, never the request's
+// origin, and no Access-Control-Allow-Credentials.
+func TestCORSAllowsAnyOriginWithoutCredentials(t *testing.T) {
+	var srv *server.Server
+
+	startApp(t, fx.Populate(&srv))
+
+	tests := []struct {
+		name          string
+		method        string
+		requestMethod string
+	}{
+		{
+			name:   "request",
+			method: http.MethodGet,
+		},
+		{
+			name:          "preflight",
+			method:        http.MethodOptions,
+			requestMethod: http.MethodPost,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			request := httptest.NewRequestWithContext(
+				t.Context(), test.method,
+				"http://chat.example.com/api/v1/server", nil,
+			)
+			request.Header.Set("Origin", "http://blog.example.com")
+
+			if test.requestMethod != "" {
+				request.Header.Set(
+					"Access-Control-Request-Method", test.requestMethod,
+				)
+			}
+
+			recorder := httptest.NewRecorder()
+
+			srv.ServeHTTP(recorder, request)
+
+			for header, want := range map[string]string{
+				"Access-Control-Allow-Origin":      "*",
+				"Access-Control-Allow-Credentials": "",
+			} {
+				got := recorder.Header().Get(header)
+				if got != want {
+					t.Errorf("%s is %q, want %q", header, got, want)
+				}
+			}
+		})
+	}
+}
+
 // startApp starts the app newApp builds, with the HTTP port
 // set to 0, so the system gives the server a free port.
 func startApp(