Hi Nik,
So, after some research, I think I found the issue, but I’m also between a rock and a hard place…
On the one hand, I need the headers I mentioned above in order to implement cross-origin isolation for this site. On the other hand, same-origin requires that everything resolves to “www.fotlr.org” (my site name) while my custom domain is “login.fotlr.org”, which isn’t a match. Furthermore, unless I’m mistaken, I can’t have a custom domain “www.fotlr.org” because the CNAME would conflict with the site’s name. Or would it?
Thanks,
David