Serve with Access-Control-Allow-Origin: *

Also, respond to /metadata

[refs #78499288]