Remove nonce; enable CORS for public endpoint