Damn I've tried everything and I can't get it to verify. I've tried:
Header set Access-Control-Allow-Origin "*"
Header set X-Frame-Options "SAMEORIGIN"
and I've tried
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Headers "*"
Header always set Access-Control-Allow-Methods "GET"
With and without
After every change I make I go to Astral and input my identifier. It fails every time.