more about sec. on this site in this thread until observable devs put out a proper official cors faq:
I think it’s a good approach for now, not for devs trying to extend this platform, but good enough for avg devs trying this platform without creating too many sec holes to shoot observable int the foot