CORS is fine, what I see is that he has no nostr address indicated in his profile.