fix: set FRONTEND_URL to bare origin so CORS allow-origin matches browser ff3303a somratpro Claude Opus 4.7 commited on 20 days ago