Khatru should be handling the CORS but no one ever knows how to do that and I forgot to test so please send a patch.

I host with cloudflare so needed to do it there, it would ignore khatru anyway 😅

I will look tomorrow