Firefox rejects credentialed cross-origin requests when Access-Control-Allow-Headers is `*`, because per the Fetch spec the wildcard is not treated as a wildcard when credentials are involved. This causes failures on endpoints like getSession and createSession when accessed from bsky.app. Switch from `.allow_headers(Any)` to `.allow_headers(AllowHeaders::mirror_request())` which echoes the browser's Access-Control-Request-Headers back verbatim, matching the behaviour of the PDS's Express cors middleware. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>