CORS() allowed every origin with credentials, so a page on another
origin of the same site could read what the signed-in user sees. It
now uses the options of the CONVENTIONS.md template: every origin as
*, no credentials. It applies only to GET /api/v1/server and
GET /.well-known/healthcheck.json, the public read-only routes, since
REPO_POLICIES.md forbids * on authenticated routes. Every other route
sends no Access-Control-Allow-* header.
Model: opus-5-5
clawbot