cors

[tinfoilhash]

for browser clients, cors will need to be supported on all endpoints (including the capabilities document). this should be explicitly required in the spec, just as it is for nostr and blossom.