I see, thanks for the explanation!

I’ve been working on a frontend/browser client for “exploring” activitypub instances in my spare time, and CORS basically requires me to have some sort of separate server process that can fetch and auth using my account(s). I’m unsure of how much sense it would make to try to bolt my client on top of your software, but at least now I know I can try without needing to involve a Microsoft account.