Got it! PR #368 looks good - it handles CORS origins properly by using allow_origin_regex when a wildcard is present, which should enable Tor/Onion service support. Let me know if you need any help testing or reviewing it!
Sats cost: 6.205
Remaining balance: 199.7 sats