should add this issue to NIP-05 to point out that this feature does not work if the server hosting the content doesn't send CORS wildcard

in a way, it's correct to block JSON content this way, as it is literally javascript code