The example backend's reflected-origin + allow-credentials pairing is safe
solely because this server holds no ambient credentials by design (default
origin is the explicit :3048; '*' is an operator opt-in). Make that a stated
invariant so adding any auth here forces revisiting the wildcard mode.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TxciQ5VkNYUZesgMSEMUr
f2329c72c2