HTTP API CORS Settings

Adding effect: true to the manifest should work?

Sorry that this is not likely fine documented