Add a minimal CORS configuration to the error responses as well.
Explain the relation between the server name and the hashed passwords.