Allow the exact Capacitor iOS WebView origin through credentialed CORS while strictly validating request-origin syntax.
cors_policy
optionsRoute