Damn I've tried everything and I can't get it to verify. I've tried:

Header set Access-Control-Allow-Origin "*"

Header set X-Frame-Options "SAMEORIGIN"

and I've tried

Header always set Access-Control-Allow-Origin "*"

Header always set Access-Control-Allow-Headers "*"

Header always set Access-Control-Allow-Methods "GET"

With and without

After every change I make I go to Astral and input my identifier. It fails every time.